Reliability and Probabilistic Risk Assessment - February 22, 2002
Official Transcript of Proceedings
NUCLEAR REGULATORY COMMISSION
Title: Advisory Committee on Reactor Safeguards
Reliability and Probabilistic Risk Assessment
Subcommittee
Docket Number: (not applicable)
Location: Rockville, Maryland
Date: Friday, February 22, 2002
Work Order No.: NRC-253 Pages 1-209
NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers
1323 Rhode Island Avenue, N.W.
Washington, D.C. 20005
(202) 234-4433 UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
+ + + + +
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
(ACRS)
+ + + + +
MEETING OF THE SUBCOMMITTEE ON RELIABILITY AND
PROBABALISTIC RISK ASSESSMENT
+ + + + +
FRIDAY,
FEBRUARY 22, 2002
+ + + + +
ROCKVILLE, MARYLAND
The Subcommittee met at the Nuclear Regulatory
Commission, Two White Flint North, T2B3, 11545
Rockville Pike, at 8:30 a.m., George Apostolakis,
Chairman, presiding.
COMMITTEE MEMBERS:
GEORGE APOSTOLAKIS, Chairman
THOMAS S. KRESS
F. PETER FORD
DANA A. POWERS
WILLIAM J. SHACK
STEPHEN L. ROSEN
ACRS STAFF PRESENT:
MICHAEL T. MARKLEY
ALSO PRESENT:
ADRIAN HEYMER
BIFF BRADLEY
TOM HOOK
DOUG TRUE
BILL BURCHILL
GARETH PARRY
MIKE CHEOK
TIM REED
PARVIS MOIENI
BOB LUTZ
LOUIS CHU
A-G-E-N-D-A
Introduction
Chairman Apostolakis . . . . . . . . . . . . 5
Industry Presentation
Mr. Heymer, NEI. . . . . . . . . . . . . . . 6
Mr. True . . . . . . . . . . . . . . . . . .10
Response to ACRS questions on NEI 00-04. . . . . .60
P-R-O-C-E-E-D-I-N-G-S
8:34 a.m.
CHAIRMAN APOSTOLAKIS: The meeting will
now come to order. This is a meeting of the Advisory
Committee on Reactor Safeguards, Subcommittee on
Reliability and Probabalistic Risk Assessment.
I am George Apostolakis, Chairman of the
Subcommittee.
Subcommittee members in attendance are
Peter Ford, Tom Kress, Dana Powers, Steve Rosen and
William Shack.
The purpose of this meeting is to continue
the Subcommittee's discussion of risk-informed
revisions to the special treatment requirements of 10
CFR Part 50. The Subcommittee will review the
proposed industry guidance in NEI 00-04, Revision B,
"Option 2 Implementation guideline." The Subcommittee
will gather information, analyze relevant issues and
facts, and formulate proposed positions and actions,
as appropriate, for deliberation by the full
Committee.
Mr. Michael T. Markley is the Cognizant
ACRS Staff Engineer for this meeting.
The rules for participation in today's
meeting have been announced as part of the notice of
this meeting previously published in the Federal
Register on January 30, 2002.
A transcript of this meeting is being kept
and will be made available as stated in the Federal
Register notice.
It is requested that speakers first
identify themselves and speak with sufficient clarity
and volume so that they can be readily heard.
We have received no written comments or
requests for time to make oral statements from members
of the public regarding today's meeting.
This Subcommittee last met on December 4,
2001, to discuss 10 CFR 50.69 and NEI 00-04 Revision
B. In a memorandum dated January 24, 2002, the ACRS
staff forwarded a list of individual ACRS member
questions on NEI 00-04 Revision B to the staff and NEI
for use in preparing for this meeting.
We would like to spend most of our time
today addressing those questions and, of course, any
other issues that our visitors would like to raise.
On February 11, 2002, the staff also
provided a list of questions on NEI 00-04. Both lists
of questions are publicly available and will be
furnished upon request.
We will now proceed with the meeting and
I call upon Mr. Adrian Heymer of NEI and his
colleagues to begin.
MR. HEYMER: Thank you, George.
My name is Adrian Heymer, I'm the project
manager with NEI responsible for risk-informed
activities covering Option 2 and Option 3.
We've got here today at the table some
utility people and Doug True, whose been helping us
with the guideline, especially in the area of
categorization.
On my left I've got Tom Hook from Dominion
and Surrey is a pilot plant. They've just gone through
the IDP. And he's here to give some insights into the
categorization and the IDP process that went on at
Surrey and what they learned from it; some of the
strengths, some of the weaknesses.
And I think it's worthwhile saying that as
we've gone through this process, this is the third
pilot activity that was done a few weeks ago at
Surrey. The first one we learned a lot; we tried to
incorporate the lessons learned into the second. The
second we learned a little bit more and refined the
process. And so when we got to Surrey I think it was
a reflection of just a general learning experience.
And that's the whole idea of the pilot activity.
I think it's true, as with all things,
that we drafted a guideline and the staff said they
thought it was of sufficient level to allow the pilots
to proceed. And we proceeded down that path
recognizing that we would learn things as we went
through the pilot activities to strengthen; have to go
back and strengthen the guidance.
Doug True is here on my right from ERIN
Engineering, and he's been helping us with
specifically on PRA issues and categorization as a
general advisor on the Option 2 activities to NEI and
the industry.
On my far right is Bill Burchill from
Exelon. And Bill has been with the Option 2 activity
and risk-informed regulation since really the start.
He represents Exelon, who was a pilot plant at the
Quad Cities that was done last year as the first one
and that really identified that we had a little bit
more work to do. And Bill will assist us in
responding to some of the specific questions.
Also in the audience we have Parvis Moieni
from Southern California Edison, Jason Brown and Bob
Lutz from the Westinghouse Owners Group. They're here
representing Wolf Creek whose the fourth pilot. And
also the Westinghouse Owners Group who have been very
active in this Option 2 activity.
And we have a few other members of the
industry from NEI in the audience.
What we would like to do today is to go
through just an overview of what we're going to cover
fundamentally. We're going to just go back and do a
very brief overview of NEI 00-04, go through that in
about 30 minutes and then get to the interactions on
those specific questions.
And then also as we go through the
process, either at the end or as we're going through
the process, we'll invite the pilots to provide some
insights into some of the pilot activities and what
they learned both from the PRA perspective, form the
PRA quality and from the categorization.
So, that's what we want to try.
The first couple of slides are really
principles, and it was just to give a sort of a
general introduction as regards what the principles of
risk-informed regulation, and it's really focusing on
the right stuff.
And we've got smart as years have gone by,
and so it's the application of NRC requirements based
on the safety significance of the equipment and the
activities. I have taken into account what we've
learned through operating experience, the design and
engineering techniques and insights from PRA and also
taken advantage of advances in technology.
And the real thrust of this is that the
real focus of the regulatory requirements should be on
those matters that are safety significant, not
necessarily at low safety-significant. And that was
really the purpose of Option 2 as we see it, and I
think it's really important if we're going to be
successful in this enterprise and this activity to
look at what really is Option 2. And it's the
application of NRC's special treatment requirements
such as QA, EQ, 50.55(a), the maintenance rule,
Appendix B, which is QA based on the safety
significance of the equipment. And it's fundamentally
a two step process.
The first step, which we're really
focusing on here and which the guideline will focus
on, is the categorization. The second step is the
application of treatment.
There are some ground rules that have been
established as we go through this, and one of those
ground rules is right up front, which was the design
basis are not changed. And I think when the industry
started off on Option 2 we had a view that perhaps we
were going to change the definition of safety related
and we would have two categories.
As we started interactions with the staff
it became clear, especially since we were going to
maintain the design basis and this was going to be an
optional activity, that in fact perhaps we should have
a slightly different structure. And the NRC staff
proposed the full box, the quadrant structure. We
took a look at that, we assessed it and we felt that
we could probably work with it. And that's we've been
trying to do. But the real thrust of this discussion
here is on the NEI 00-04, the categorization process
and that's what we're here to talk about today.
I'll now hand over to Doug True, whose
going to give a very brief overview. And we probably
won't go through all these slides as a matter of time,
but we will just give you a very rough overview of
what NEI 00-04 talks to as regards to categorization.
MR. TRUE: Do they have this?
MR. HEYMER: Yes. You should have the
handout.
CHAIRMAN APOSTOLAKIS: We don't. We have
yours.
MR. HEYMER: No. It's the same thing --
CHAIRMAN APOSTOLAKIS: It's the same
thing?
MR. HEYMER: No.
CHAIRMAN APOSTOLAKIS: No, it can't be the
same thing.
MR. HEYMER: There were two sets in the
package I just gave you. One was the --
CHAIRMAN APOSTOLAKIS: Oh, there were?
You guys got it? Yes, we didn't get it. All right.
Let's go on.
MR. HEYMER: Well, it's early in the
morning. I sort of lost a few marbles last night or
something.
CHAIRMAN APOSTOLAKIS: Okay. Doug?
MR. TRUE: Okay. As Adrian said, we have
a lot of material here. I'll just kind of slip
through these quickly and kind of hit on a few high
points in order to get through this quickly and get on
to the questions.
I'm going to skip through to I think it's
the fifth slide, safety-significant attributes. I
just want to make a couple of quick points on that
subject.
One of the things that we started with,
actually, in the Option 2 effort within the task force
was to look at well if we think about what PRAs have
told us, we're going to find what are the differences
and where are we going to find differences in what the
design basis has told us about important equipment and
what PRAs have told us. And we kind of keyed in on
this notion of safety-significant attributes.
So for the equipment that were identified
as safety-significant through whatever categorization
process we used, we wanted to keep track of that, what
attributes of those components made them safety-
significant.
And that comes from the fact that the
performance requirements for the design basis in some
cases are more limiting than for PRA or for risk
assessment perspective, and in other cases the
accident performance is more limiting than the design
basis. So we have this kind of mix and match we have
to reconcile.
And as part of the categorization process
we expect the categorization team and the IDP to
address those attributes which make the SSCs safety-
significant. And those things include the functions,
the performance attributes, the pressure flows,
temperatures, environment; that kind of thing, and any
actuation requirements.
And just as kind of a point of reference,
we provided two hypothetical examples which are not a
particular reach in this area.
First in the area of RISC-1s, those are
the safety related, safety significant SSCs. For BWRs
the ability to vent a containment and remove decay
heat is often a safety-significant function. And so
we realized that containment vent valves, which are
part of the containment isolation system, might end up
being safety-significant. And while their design
basis function was to close to isolate the
containment, there severe accident function or core
damage in the containment failure function was to open
and control -- open and close in order to control
containment pressure and allow decay heat removal. So
we were expecting the valves to do the opposite thing
that the design basis expected them to do.
And here's some examples of the safety-
significant attributes that might be tracked in this
process include: What are the conditions we're
expecting the valve to have to open under; what kind
of capability does the PRA assume we need for being
able to open that, whether it's from the control room
or be able to do that locally using air bubbles or
whatever. Different PRAs and different plants have
different capabilities in those areas.
But as we moved forward and we implement
Option 2 and we made changes to the plant, we would
want to keep track of those attributes and put that
into our change control process so that we didn't lose
track of the fact that those were now important
functions for those components.
In the RISC-2 area, which is a non-safety
related but safety-significant SSCs, an example might
be a startup feedwater pump that was originally
designed to help the plant go through power ascension
and shutdown has no particular design basis from an
accident analysis perspective, but in some plants it
probably provides a risk significant function of
making up to the steam generators as a backup to aux
feedwater effectively in cases where all aux feedwater
might be lost.
In that case, we certainly would want to
keep track of the flow and head requirements, which
probably are not a lot different than design basis.
But in some plants also the ability to attach that
startup feedwater pump to 1E Bus and power from a
diesel generator so that it works in the event of a
loss of offsite power is an attribute that we would
want to keep track of and not lose over time as the
plant changed.
CHAIRMAN APOSTOLAKIS: What you are
categorizing is a component, right? I mean, if I look
at the matrix, I will see components in there not
attributes or anything?
MR. TRUE: No. You categorize the
component.
CHAIRMAN APOSTOLAKIS: Yes. So this
discussion helps us do that, is that what you're
saying?
MR. TRUE: I think all we're saying is
that there's an adder -- when we go to the process of
-- through the process of categorizing we say this
startup feedwater pump is safety-significant, we want
to not only know that it's safety-significant, we want
to know why it's safety-significant so that we
incorporate those attributes into the change control
processes going forward in the plant and we don't lose
track of that.
CHAIRMAN APOSTOLAKIS: Yes. Well, and
that presumably --
MR. TRUE: And that the treatment is
focused on those aspects.
CHAIRMAN APOSTOLAKIS: Presumably when you
declare the safety-significant, you went through this
process, right? You knew already. I mean, that's why
you said it was safety-significant because of all
these things? And then you pass that along to whoever
makes a decision?
MR. TRUE: Right. Right. But, for
example, the startup feedwater pump, it is not safety-
significant in being able to function post-seismic
event. See, we can't paint all the components with
the same brush because it's not like the safety
related designation which automatically gets category
1 seismic and 1E power and all those things.
In this case we're going to have a little
bit more mixture of attributes that are important and
we're going to have to keep track of those.
CHAIRMAN APOSTOLAKIS: So that would be
more relevant when you decide what treatment to apply?
MR. TRUE: Yes. Yes.
CHAIRMAN APOSTOLAKIS: Which is very
different from the current practice of safety related
gets all --
MR. TRUE: Gets everything and everything
else is treated in a different way.
CHAIRMAN APOSTOLAKIS: I believe South
Texas had a separate category for that in the middle
somewhere there where it was focused. But anyway,
let's go on.
MR. TRUE: The four step process, I'm
going to kind of skip through that. And just talk
about a little bit the structure of the categorization
process. Slide 8.
As you know from reading the document,
we've tried to utilize the PRAs where they're
available and use importance measures as a screening
tool to identify the potentially safety-significant
structure systems and components. We then utilized
some sensitivity studies to test the robustness of
those base importance measures.
One of the things we were looking for in
the categorization process was one that was relatively
robust and stable and we're not going to have SSCs
jumping in and out of the categories over time. And
so we've tried to use the sensitivity studies as one
of the ways to make sure we are assuring that that's
the case.
Where PRAs aren't available, we've tried
to be more conservative in the way we've applied the
categorization process knowing that if utilities
wanted to go off and develop a PRA in an area where
they don't have one and gain some additional benefit,
they could do that. But if they had a seismic margins
analysis, for example, instead of a seismic PRA we
wanted them to be able to use that as part of their
categorization scheme.
We take all that risk information and
supplement it with some defense-in-depth assessment.
And then finally at the end we do a sensitivity study
to look at the aggregate impact of a postulated change
in all of the RISC SSCs simultaneously jumping to some
higher unreliability to make sure that that change was
small.
And, as I said, the objective was to
develop a scheme that was comprehensive, didn't just
focus for example on internal events and kind of hand
away through the other hazards and operating modes,
and robust to the importance measures, took into
account the fact that there could be variations in
them. And then long term stable so that we weren't
having equipment jumping from one category to another
over the life of the plant.
DR. ROSEN: Doug, you would acknowledge,
would you not, that your next to last bullet while it
is bounding, it's certainly unrealistic?
MR. TRUE: I think it is very unrealistic.
That all of them would go to some upper level of
value.
DR. ROSEN: All at one time -- suddenly?
MR. TRUE: All of them.
DR. ROSEN: And all at one time?
MR. TRUE: All at one time. Without you
noticing it.
DR. ROSEN: And without anything to do --
I can't imagine anything that could do that to all the
components.
MR. TRUE: In fact, we believe that likely
there will be very little change in the performance --
DR. ROSEN: Well, that's totally
unrealistic.
MR. TRUE: Yes.
DR. ROSEN: But the answer that comes out
of that sensitivity study in the next to last bullet
is really very unrealistic.
MR. TRUE: I believe so. But if we need
it, or we use it because we realize that there are
shortcomings in using individual importance measures.
And if you're going to -- individual importance
measures are going to make any decisions about
individual components of getting insights about
individual components, we're talking about a batch of
components and the individual importance measures are
not useful for that. So a sensitivity study is a way
to address the fact that there could be synergisms
that we want to look for in that aggregate of
assessment helps us --
DR. ROSEN: But nobody should use the
number that comes out of that and believe it as being
anything that's physically real?
MR. TRUE: Correct.
DR. KRESS: Wouldn't it be better to treat
that like a common-cause failure or you only change
the failure frequency of one of them, but use some
multiple Greek letter to get the probability of
failure of the others in order to get an importance
measure? What do you think, George? Rather than just
say the whole group has a --
CHAIRMAN APOSTOLAKIS: To have a lower --
yes.
DR. KRESS: Because they're not all going
to fail at the same time.
CHAIRMAN APOSTOLAKIS: Sure.
MR. TRUE: Well, they're not all -- we're
not saying when they all fail. We're saying their
probability of failure all goes up by a factor.
DR. KRESS: When you do the RAW for the
group, you assume that measure is all of them going.
MR. TRUE: Yes, the RAWs are done
individually as a part of the screening process.
DR. KRESS: Oh, you're not doing --
MR. TRUE: No. No.
CHAIRMAN APOSTOLAKIS: They just do
probability.
DR. ROSEN: Just going to a Delta CDF for
the group, but through the sensitivity study.
MR. TRUE: Through the sensitivity study
of increasing the unreliability --
DR. KRESS: That's by increasing the
factor of 10. But the RAW is simply for one
component--
MR. TRUE: For individual events.
DR. KRESS: Yes, that's what I think you
ought use, common-cause and get a different RAW than
that.
CHAIRMAN APOSTOLAKIS: Yes, we'll come
into that discussion.
DR. KRESS: Okay.
DR. POWERS: Can you give me some more
insight of what a defense-in-depth assessment looks
like?
MR. TRUE: Yes, if you'll hold on just a
couple of slides, we'll get to that.
CHAIRMAN APOSTOLAKIS: Now, when you say
your PRAs are not available, what does that mean?
That they are not available because nobody has ever
done a PRA for this particular mode or this particular
licensee happens not to have a PRA for something for
which others have done a PRA?
MR. TRUE: The latter. Where a plant does
not have a PRA currently.
CHAIRMAN APOSTOLAKIS: So there should be
a clear demonstration then that the categorization
process is conservative in that case, and we'll come
back to that during the discussion I hope?
MR. TRUE: We can. I actually didn't plan
on all those flow charts that go through every
different way we look at things. We can --
CHAIRMAN APOSTOLAKIS: I mean, there was
a question on fires which you presumably have
addressed?
MR. TRUE: Yes. Yes.
CHAIRMAN APOSTOLAKIS: There was a
question. So when we come to that, we'll probably
raise a similar question.
MR. TRUE: Okay.
DR. SHACK: Well, since you're not
covering that, let me just -- you know, as I read the
seismic margins analysis, for example, it looks to me
like you're protecting your one shutdown path, at
least that's the way I read this. You know, I look at
what I need for that one shutdown path and I
categorize to maintain that shutdown path. But in
fact, I couldn't in fact be upping my risk because I'm
not really paying attention to the other things that
are neglected in the margins analysis that could in
fact give me an assessment. So my change in risk
could be larger than I think it is?
I'm not sure how in the margins analysis
you assure that your categorization process is
conservative.
CHAIRMAN APOSTOLAKIS: Or the final
analysis.
MR. TRUE: Well, it's the same sort of
thing. Anytime you have the margins analysis --
CHAIRMAN APOSTOLAKIS: That's right.
MR. TRUE: -- and you're protecting one or
a limited set of shutdown paths --
CHAIRMAN APOSTOLAKIS: A screening.
Whenever you have a screening process to demonstrate
that something is not important, it's not clear to us
how you handle it and whether the results are
conservative.
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: So I don't know
whether you want to address it now or later.
MR. TRUE: We can come back.
CHAIRMAN APOSTOLAKIS: We'll come back to
it. Okay. Great.
DR. FORD: Can I follow up on this
question of the areas where there is not a PRA?
MR. TRUE: Yes.
DR. FORD: In reading through the 00-04
document I was looking for references to time
dependent degradation of passive components. And I
couldn't find anything at all in that document which
related specifically to that. And degradation of the
containment, for instance, or some of the passive
components like core shrouds or whatever.
If there was a component which was safety
related and was put into RISC-3, how would that be
determined when you don't have a time dependent PRA
for those phenomena? Could it be done by an IDP
process? And if so, who would be the experts on the
panel to address this?
MR. TRUE: I think the categorization
process in 00-04 isn't really designed to deal with
passive loads of components. There's a separate --
DR. FORD: Passive components are
mentioned in 00-04.
MR. TRUE: Yes, I think we hand it off to
the ASME.
MR. HEYMER: Yes. The prime thrust of the
categorization that we cover is dealing with active.
When we get to passive there are ASME processes out
there that look at classification of passive
components. And what we say is that it's assumed to be
where it is today, unless you've done one of those
passive categorization schemes that is run through
ASME. And then if you've done that, then you can
start looking at things like the pressure boundary.
But that's what you've got to do.
So we hand off to, we point to another
group that's already done that work. And so we're
relying on those.
DR. FORD: So time dependent degradation
of passive components; pressure boundaries, core
shrouds which are not pressure boundaries, but things
of this nature which are safety related are not
covered in this document?
MR. HEYMER: If they're not covered by the
ASME process, they're not covered by this document.
DR. FORD: Okay.
MR. HEYMER: Tom?
MR. HOOK: Yes. I just wanted to make a
point that in the current draft of ASME code case that
categorizes passive components for the Option 2 effort
it makes the assumption that those passive components
are failed for the purpose of the categorization.
That the failure rate is 1.0 and only focuses on the
consequence of failure.
So, items like core shrouds and
containments all come up as high because of that
process.
DR. FORD: So they'd be automatically in
RISC-1 and RISC-2?
MR. HOOK: Right.
DR. FORD: Okay.
MR. TRUE: Okay. We use a variety of
quite specific RISC information and deterministic
information. I don't need to spend any time on that.
PRA quality, I had several questions that
dealt with that which we'll get back to, but I thought
it deserved a brief discussion.
The 00-04 allows for the use of NEI 00-02,
which is the peer review process or the ASME standard
for evaluating the quality of the internal events at-
power PRA. We believe out of both of those documents,
the peer review provides the greatest insight into the
strengths and limitations of the PRA. And that the
observations that come out of that peer review
process, whether it's one driven by the ASME standard
or from 00-02 have to be dispositioned as part of this
process. And those are either dispositioned by
incorporating -- making a change to the PRA model to
address the observation, look for a way to handle that
through sensitivity studies which are then passed on
and looked at as part of the categorization process,
or provide some justification that the assumption or
the issue that's raised in the observation doesn't
effect the categorization. I think that that third
one is probably the least likely to be used, but there
may be cases where depending upon the comment, that
might be applicable.
Then it's up to the utility or the
licensee to provide a characterization of the PRA
quality. And that's submitted to the NRC staff at the
time you enter into the Option 2 process and before
categorization is done, along with an explanation of
the scope and schedule of what's going to be done.
And that characterization, and as well as
passed on to the integrated decision making panel so
that they understand what they're dealing with in
terms of the PRA quality.
And the things we want to look at are:
How well does the PRA address the as-built as operated
plans; what did the peer review say about the internal
events PRA; how were those observations that were
classified as significant in 00-02 parlance, that's A
or B --
CHAIRMAN APOSTOLAKIS: But this list
doesn't say anything about uncertainty. And it talks
a lot about sensitivity.
Now, as far as I know, the standard
computer codes that the industry is using to do their
PRAs have capability of propagating uncertainty, the
standard behind, you know the failure rate
uncertainty. And I'm surprised that you resort to
sensitivity studies all the time. Why? What's wrong
with or is it so expensive to do? I mean, it would
seem to me that it's kind of routine these days to do
that.
MR. TRUE: Yes. I don't think -- I guess
there are two things about that. Certainly there are
tools available for the major PRA codes to allow you
to do uncertainty calculations on the parametric
uncertainties at least.
CHAIRMAN APOSTOLAKIS: Yes.
MR. TRUE: The sensitivity analyses that
we're talking of tend to be more focused on the
modeling and assumptions of the model.
CHAIRMAN APOSTOLAKIS: Well, that's not
the impression I get when I read NEI 00-04, and we'll
come to that. I mean, I would agree with you a 100
percent that that's what should be done. But if you
read the document, that's not what it says. But this
is one of our questions.
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: So we'll come to
that.
MR. TRUE: In particular related to the
facts and observations in this slide where we mention
sensitivity analyses, I believe it's relatively rare
to have comments about the uncertainty distribution on
individual perimeters that come out of the peer review
and have those be an A or B significant in the overall
result.
CHAIRMAN APOSTOLAKIS: Well, we'll see.
We'll see.
MR. TRUE: So it's usually we're dealing
with you didn't use this seal LOCA model or you made
this assumption about room cooling or time for
operator actions, or those kind of things.
CHAIRMAN APOSTOLAKIS: Well, for those I
fully agree that the sensitivity analysis would be
very useful. But, again, I mean when I read the
document that's not what it says. So we have to fix
that.
MR. TRUE: Okay. Well then --
CHAIRMAN APOSTOLAKIS: Now, I have another
question on this.
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: It seems to me, I'm
a little bit concerned that if one has a PRA, we're
going to spend a lot of time talking about its
quality. If one does not have a PRA, then we wave our
arms, we do screening analysis and we come up with
some results that may be questioned for 10 minutes,
and that's it. Is it really over kill here just
because you happen to have the study? Then we talk
about the quality, have you used the ASME standard,
have you used the industry certification process. And
then we go to the fire and seismic and say, well, I'll
do some screening calculations and here is my
categorization. And believe me, it's conservative.
I mean, just because -- in other words,
are we penalizing people for doing PRAs because now
they have to defend them forever? It should be the
other way around. Your life should be much more
difficult when you don't have the PRA.
MR. TRUE: That's a wonderful question on
excellence.
CHAIRMAN APOSTOLAKIS: Well, let's go on.
It's just that I'm curious just because we have
something, we scrutinize it to death and then in
another area we say well we're going to do some
conservative calculations and they will be good
enough.
MR. TRUE: Yes.
DR. POWERS: If the calculations are
demonstrably conservative --
CHAIRMAN APOSTOLAKIS: Are they in the
other areas? I mean, I look --
DR. POWERS: They demonstrative to be
conservative and the PRA is demonstrably realistic,
then isn't that the appropriate split of labor?
CHAIRMAN APOSTOLAKIS: Yes. But you put
to big "ifs" there. Yes, certainly.
MR. TRUE: Well, I think the second half,
I mean the PRA is intended to be realistic. So that's
the --
CHAIRMAN APOSTOLAKIS: I understand that.
MR. TRUE: I think it gets more attention,
which is part --
CHAIRMAN APOSTOLAKIS: I think we should
make sure that the quality of the decision making
process, you know, and its inputs is more or less
uniform in the places where we have a PRA and in the
places where we don't. And, again, I'm not convinced
that that's the case. Okay, let's put it that way.
I'm perfectly willing to be convinced, but I am not
right now. And I think again as we discuss our
questions later, these issues are going to come up.
MR. TRUE: Okay. One other thing about
the PRA and the quality of the other analyses. It's
still incumbent upon a licensee to demonstrate that
they reflect the as-built/as-operated plant and that
the things that carry over from the internal events
PRA that may have been significant in that PRA, which
is usually the basis for the other mode and hazard
analyses, are properly addressed and identify any
sensitivity studies necessary to address other areas
of concern. And that's passed on to the IDP as part
of their considerations.
CHAIRMAN APOSTOLAKIS: Why such an
emphasis on the internal event PRA? I mean, you
wouldn't want the fire PRA to reflect the as-built and
as-operated?
MR. TRUE: Yes. No, that's what I was just
saying. The last three bullets are the other PRAs.
And we have basically the same standard for those that
we have to reflect the as-built/as-operated plant.
That the peer review comments that have been received
on the internal events PRA, which is usually used as
the input for fire PRA, at least for doing the
conditional core damage probability calculations, have
been addressed and don't effect the fire PRA, for
example. And then look for any PRAs where there's a
need for sensitivities to address issues in those PRAs
also.
CHAIRMAN APOSTOLAKIS: Now, in your --
MR. TRUE: I think we have the same
standard on both. But because and practically
speaking the internal events PRA tends to be the
center and the focal point or the kernel of all the
other PRA analyses come from, we tend to put more
words around the internal event study.
CHAIRMAN APOSTOLAKIS: Even though we know
that the experience over the last 25 years with PRAs
has told us that fires and earthquakes usually
dominate the risk, right?
MR. TRUE: It depends upon the plant, but
that certainly wasn't South Texas' experience, but --
CHAIRMAN APOSTOLAKIS: Well, it certainly
does --
MR. TRUE: -- other plants.
CHAIRMAN APOSTOLAKIS: -- but overall I
think it's a true statement that they if not dominate,
they are among the dominant contributors?
MR. TRUE: Yes, I would agree with that.
Yes.
This was in case we wanted to talk about
this.
Step 2, which is the actual categorization
process and all of the figures that go along with
that, we're looking at CDF and LERF. Importance
measures are used as a screening tool. We look at
both the initiator and the event mitigation. And
we're looking for those attributes.
Back to the question about defense-in-
depth, what we try to do there is step beyond the PRA
itself and provide some additional information to the
IDP on the defense-in-depth and the role that the SSC
plays in providing defense-in-depth.
In particular for the RISC-3 SSCs, we have
a process that we go through to looking at both core
damage and early containment failure prevention and
the role of SSC plays in defense-in-depth in that
area.
CHAIRMAN APOSTOLAKIS: Again, I'm a little
confused here. It seems to me that if you have a
robust PRA and you're using the importance measures
from the PRA, the question of defense-in-depth should
not arise because that's built into the PRA. That's
why the Fussell-Vesely in RAW came out the way it did,
because of the defense-in-depth.
Defense-in-depth should be an issue when
you're now departing from the PRA, when you
categorizing SSCs in areas where you don't have a good
PRA or you don't have a PRA at all.
Why would I care? I mean, the fact that
this pump is part of a one out of three system in the
PRA is reflected on the importance measures. So on
top of that I want to think about defense-in-depth
again, unless I have left something out?
So I think these things should be made
clear that, you know, when the panel is deliberating
certain things are relevant to certain things and in
other cases they're not relevant.
I mean diluting the input here it seems to
me. That's why it all comes out the way it does,
because there is some different -- like at South Texas
they have higher redundance than the average plant. So
if I calculate Fussell-Vesely in RAW, I will see that
there. Now in other instances where I don't have a
PRA, then I want to alert the panel to the fact that
they have to worry about defense-in-depth.
This is simple enough?
MR. TRUE: Well, your question is simple
enough. I think the answer may be simple enough also,
and we kind of skipped through this in the guiding
principles. That we started with 1.174 in the
principles of risk-informed regulation in where we
wanted to go. And some of the things in 1.174 invokes
in the defense-in-depth area are there's reasonable
balance, diversity or redundancy not introducing
common-cause failures.
CHAIRMAN APOSTOLAKIS: Yes, I know.
MR. TRUE: Those kind of things. And
that's what we were trying to address through the core
damage.
CHAIRMAN APOSTOLAKIS: Yes, but I mean we
should be going beyond 1.174 wherever we feel that we
know enough now. That's already a four year old
document, right?
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: What I'm saying is
not necessarily inconsistent with what's in 1.174.
It's just a further refinement, I think.
My point is this question is much more
important in the cases where the panel does not have
a PRA they can rely on, or maybe not at all, then when
they have a PRA. For the internal events that's very
good and has gone through the reviews and all that.
Because then the importance measures reflect that a
degree of defense-in-depth that's in the plant.
MR. TRUE: Yes.
CHAIRMAN APOSTOLAKIS: And I believe that
should be part of the training of the panel. There
should be a training session where they would
understand what the whole situation is.
Steve, do you have anything?
DR. ROSEN: No. I think you have it
exactly right, George.
DR. KRESS: Well, I think with one
problem, and that is if I look at redundancy and
diversity of mitigation systems and bypass, isolation
and early hydrogen burn and things having to do with
long term containment integrity, those will be in the
PRA. I don't know what defense-in-depth things will
not be in the PRA that you have to alert the panel to.
And that's what my problem is.
CHAIRMAN APOSTOLAKIS: Well, but --
DR. KRESS: There probably aren't any.
CHAIRMAN APOSTOLAKIS: Well, if there is
a PRA, yes, I'm with you. But there are many other
situations where they're categorizing things without
a PRA or using a screening approach.
DR. KRESS: Like fire or seismic?
CHAIRMAN APOSTOLAKIS: Yes. Yes. Then
they have to worry about this.
DR. ROSEN: Or things that aren't modeled
in the PRA.
DR. KRESS: Yes. But those won't be these
things. They --
DR. ROSEN: They will typically be in
RISC-4 anyway.
CHAIRMAN APOSTOLAKIS: Right. Right.
There is a reason why they're not in the PRA.
DR. ROSEN: That's right. Because the
analysts couldn't envision a sequence in which that
was imperative --
CHAIRMAN APOSTOLAKIS: Well, it seems to
be that point --
DR. ROSEN: But you have a point with fire
and seismic, though.
CHAIRMAN APOSTOLAKIS: Yes.
MR. HOOK: Because those can be important
and they're not a PRA.
CHAIRMAN APOSTOLAKIS: I mean clear cut
guidance like that I think would help a lot, not only
with the categorization, but moving things along, you
know. So next time, for example, we visit 1.174 we'll
have the benefit of all this.
By the way, NRC staff is you ever feel the
need or urge to jump in, do not hesitate.
Mike?
MR. CHEOK: This is Mike Cheok.
A quick comment of this defense-in-depth.
I think you're right that if it's in the PRA, that
should be a consideration in your defense-in-depth
considerations. But remember that the importance
measures now only deal with CDF and LERF and we need
to pull in things like long term containment heat
removal using the defense-in-depth arguments.
CHAIRMAN APOSTOLAKIS: Well, if you are
changing the objectives of the categorization, then of
course, you're absolutely right. But that's exactly
what I would like to see in black and white; do this
in that case, do that in the other case. So what
you're doing now is you're going beyond what the
importance measures reflect. And then, of course,
you're right; you have to worry about it. You are in
the category of cases where you don't have a good PRA
result, right?
DR. KRESS: Or alternatively there's no
reason why you couldn't have an importance measure for
those things.
CHAIRMAN APOSTOLAKIS: For those things,
yes. Sure.
MR. CHEOK: That's correct. But, you
know, right now we have the CDF and LERF matrix as to
one step we are looking into.
CHAIRMAN APOSTOLAKIS: That's right.
MR. CHEOK: Unless we expand those matrix,
we have to deal with defense-in-depth.
CHAIRMAN APOSTOLAKIS: Well, that's my
whole point, that we can say: (1) for CDF and LERF if
the PRA's of good quality, then there's no other
issues of defense-in-depth. Those are all built into
it. Then (2) now if you want to worry about the late
containment failure and so on, then of course the
Fussell-Vesely in RAW do not reflect those, as they
are calculated today.
DR. KRESS: But they could.
CHAIRMAN APOSTOLAKIS: Adrian? Oh, sure.
MR. HEYMER: As regard the input into the
discussion, we can have it now or we can take it later
on when we get into the questions. But it might be
worthwhile hearing from some of the pilots.
CHAIRMAN APOSTOLAKIS: Certainly. Any
time. Yes.
MR. HEYMER: That have gone through this
process, for them to just briefly describe how they
addressed that in specific instances.
CHAIRMAN APOSTOLAKIS: Yes, we can pick up
these things again when we talk about the question.
MR. HEYMER: Okay. Well, we'll wait until
then.
MR. BURCHILL: This is Bill Burchill from
Exelon.
You made a comment that I think I'd just
like to make we understand your comment.
One of the fundamental principles in our
approach as an industry to supporting this Option 2
initiative is that we would be consistent with the
current framework of risk-informed applications that
are specified by the regulation. And, you know,
whether 1.174 is going to change in the future, it
currently provides the direction to evaluate from a
number of different perspectives.
And I think you're absolutely correct that
where we have a PRA, we think it provides sufficient
information, but on the other hand what we've also
done is responded to those guidance from the current
regulatory environment that says advise the IDP on
whether there's an impact.
So when we look at defense-in-depth it
doesn't necessarily mean that we're doing something
separate from the PRA that would necessarily be in
conflict with it, but having done the PRA and having
done the categorization, we say well does that have
any impact on defense-in-depth and then we advise the
IDP whether or not that's the case.
CHAIRMAN APOSTOLAKIS: Yes. I didn't mean
to imply that you should deviate from 1.174. For
heaven's sake, no. But you can certainly refine
certain things.
And my other point is that the panel
typically will not consist of experts who understand
the PRA and its subtle and then understand the plant,
and understand all sorts of things.
DR. ROSEN: George, excuse me. I think it
will. At least in the South Texas case and I assume
that the staff would insist on similar capability in
other cases of other licensees, the panel has a risk
and reliability expert on it. Not every member is a
risk and reliability expert.
CHAIRMAN APOSTOLAKIS: That's true.
DR. ROSEN: But there is one, and his job
is to keep the panel informed of any implications like
the ones we're talking about.
CHAIRMAN APOSTOLAKIS: My point is that
the more explicit the guidance to the panel, the
better off all of us will be. Okay? And making sure
that you discuss the defense-in-depth assessment
appropriately, but in certain instances is not as
important in others. That means that would be a
useful thing rather than saying defense-in-depth is
important, you have to look at it in a blanket sort of
way.
MR. BURCHILL: Bill Burchill again.
Yes, I think you're absolutely correct.
And I think if you have a full compliment, let me put
that way, of PRA information that's applicable, then
the defense-in-depth becomes a supplementary piece of
information, perhaps confirmatory or perhaps just
advisory. But as you point out as well, where you do
not have the PRA information and perhaps are you only
using screening techniques, the defense-in-depth
probably becomes a more important part of the mix of
information.
MR. CHEOK: George, real quickly I just
want to read 2 sentences from 1.174. It says here
that it -- I just lost the place.
"It has been and continues to be an
effective way to account for uncertainties. If
comprehensive risk analysis is done, it can be used to
help determine the appropriate extent of defense-in-
depth to ensure protection of the public health and
safety. When a comprehensive risk analysis is not
done or cannot be done, traditional defense-in-depth
considerations should be used or maintained to account
for uncertainties."
That's what 1.174 says and I think it
agrees with you just said and what Bill just said.
CHAIRMAN APOSTOLAKIS: We all agree.
DR. FORD: Could I just ask a question
about the final bullet? By that do I understand
physically what you're considering is long term
degradation of concrete and the rebar?
MR. TRUE: No.
DR. FORD: No.
MR. TRUE: We're talking about the long
term -- well, no unearly failures of the containment
under severe accident conditions. Failure to remove
decay heat, long term over pressure over temperature
conditions.
DR. FORD: Okay. Because I know that in
the plant license renewal area the integrity and
degradation of the concrete of the rebar is under
consideration, but that's not what you mean in here?
MR. TRUE: No. No.
DR. FORD: Okay.
MR. PARRY: Can I just add a comment, just
to clarify that.
This is Gareth Parry from the staff.
What's under consideration here, things
like the systems that are used to remove decay heat,
like the RHR system, containment sprays, fan coolers
but not the structures themselves. I think that's
right.
MR. TRUE: Correct. Correct.
DR. FORD: What about integrity of the
containment, the physical integrity? I mean, at
Oyster Creek I know that there we had problems -- I
think it was Oyster Creek. We had problems of
degradation, however in that case some of the steel.
Does that come into this out of all in the
categorization of RISC-3 components?
MR. TRUE: I don't see a path that someone
could conclude that the containment is RISC-3. The
containment pressure boundary is RISC-3. So I think
we believe that the treatment of the containment will
continue as is and we're talking about changing the
treatment.
DR. FORD: Okay. Not going to change
that?
MR. TRUE: Same is true of the reactor
coolant system --
CHAIRMAN APOSTOLAKIS: Are you saying that
these categorization process as a generous statement
does not apply to passive components? Is that what --
I mean, Dr. Ford has asked two or three questions so
far and I'm not sure what the answer is. You refer to
the ASME case.
MR. HEYMER: Where the ASME code cases
reflect, which is really focused on piping and vessels
and such.
CHAIRMAN APOSTOLAKIS: Right.
MR. HEYMER: If the licensee wishes to
involve that code case and use that, then he can
incorporate the results from that passive
categorization into what he's gotten by the pressure
boundary. Otherwise, the pressure boundary would stay
as it is today.
We do not see things like containment
structures being included in that, and as such they
would stay exactly as they are today. And I think one
of the principles we have is that the component or the
structure stays where it is today unless you can show
that it's of low safety significance.
DR. ROSEN: But even in that case, Adrian,
if the licensee wishes to use a code case, what you're
doing is accepting or utilizing some flexibility to
change the inspection intervals or testing intervals,
but not to remove the components from scope?
MR. HEYMER: Well, in this case we would
look beyond that. We would take it to the next step.
So you --
DR. ROSEN: You've gone through the code
case you're saying?
MR. HEYMER: Yes. So if it came down, it
wouldn't just be increase in the interval necessarily
of the inspection activity.
MR. CHEOK: I think the way the staff
views this issue is that everything starts off as
RISC-1 and it stays in RISC-1 unless you have
justification to move it to RISC-3. So if you want to
move a passive component from RISC-1 to RISC-3, you
would have to use, for example, the ASME code cases to
justify moving it to RISC-3.
DR. FORD: So if the staff came to you and
said the containment vessel on the Seaborn Station and
as an informed member of the public, I could say the
rebar is going to corrode. The staff asked you prove
to me that the containment has still got its original
design integrity; that would be kicked into the
current in the IDP process?
MR. HEYMER: Well, no. That to me is a
completely different issue associated with the current
design and the integrity of the containment as it is
today and is not a risk-informed activity. This
process doesn't go out and say is the equipment
adequate today. We assume it is. What we're doing is
going through a categorization process to look at the
insides and say if it's 1 today, can we justify making
it of low safety significance? It doesn't take into
account well is the design with the design assumptions
or the corrosion rates, etcetera, are they still valid
today. To us that's a different question.
DR. FORD: Okay.
CHAIRMAN APOSTOLAKIS: Shall we go on to
the questions now or you have more?
MR. PARRY: I mean, we've discussed the
defense-in-depth. You've insisted that the PRA has
everything we need in it for looking at core damage
issues. And I look at the slide and it seems to have
some sort of a balancing between mitigation and
prevention in it, kind of what you look for in those
context.
What you also stipulated was that perhaps
a defense-in-depth assessment is more required for
some issue like fire. And when I look at the slide it
does not have anything in it that's familiar to the
issues of defense-in-depth when I think of fire.
Now, is that just translation or is there
some understanding here that these words deal with the
prevention of fire; the detection and suppression of
fires and the prevention of damage caused by fires
here hidden in these words?
MR. TRUE: No, there's nothing hidden in
the words. I think fire is a difficult one when
you're searching for defense-in-depth, because as a
practical matter we have designed our plants to have
a protected train in most cases for fires. So if you
have a fire, a large fire, you'll be left with one,
exactly one train of mitigation which by definition
isn't really defense only. It's a level of defense-
in-depth, but you're not going to get more levels of
defense-in-depth than one in most plants for most
situations.
MR. PARRY: In most plants.
MR. TRUE: Unless you're South Texas and
you have three 3 trains and they're all separated and
one of the last plants built in the country.
In most plants in the U.S. we have gone to
a -- Appendix R has driven us to this single path.
And because of the initiating event frequencies we see
in fire PRAs, I don't see how a train that's used to
mitigate a fire could ever have low safety
significance because there's only one train.
And so I don't think we're going to find
a lot of additional defense-in-depth in the fire area.
It's just my experience from doing fire PRAs.
MR. BURCHILL: Bill Burchill from Exelon.
I guess I'd like to temper that just a
little bit. If you talk about the Appendix R bounding
fire, you know what we call an exposure fire, what
you're saying is correct and the plant is designed
specifically to provide a path for its protection.
But in fact, the fires that will be more likely to
occur in the plant at a higher frequency level are not
bounding exposure fires or large control room fires,
or something of that nature.
Most fires that have and probably will
occur in a plant are of a much less extensive impact.
And in those cases certainly the fires are protected
through the use of the EOPs. You don't get your
extreme safe shutdown procedure. You're working
through EOPs. And, in fact, you do look for defense-
in-depth. You do look for any pathway that can control
pressure, reestablish inventory if that's necessary.
You know, obviously decay heat removal and so forth.
So, I think we have to be very careful not
to let our thinking be dominated by the Appendix R
design base approach. For that case what Doug is
saying is certainly true. But for the more likely
situation there are certainly are a number of ways
that are available and, in fact, are actually invoked
through the use of the EOPs.
CHAIRMAN APOSTOLAKIS: But I think the
general -- I'm sorry.
MR. BURCHILL: And in fact, that's what a
fire PRA represents. I mean, a fire PRA starts by
going through what is the realistic response. We had
this discussion, I think at an ANS meeting, Dr. Rosen.
In fact, the PRAs going to represent all
those realistic paths.
CHAIRMAN APOSTOLAKIS: But I mean would
the door, for example, that's supposed to be closed to
prevent fires from spreading from one compartment to
another, the smoke and so on, would that be part of
the defense-in-depth philosophy? I mean, that you
want these doors closed and so on because you are
preventing the fire from spreading; and that's not
going to be in the PRA I don't think.
MR. TRUE: Right. Right.
CHAIRMAN APOSTOLAKIS: You know, if there
is a PRA. So is that kind of thinking in part of the
guidance to the panel or they will think about it
naturally because they're experienced people? I don't
know how that works.
Now, the fire protection engineers, you
know, when you speak about defense-in-depth, they will
tell you we have measures to prevent fires from
occurring. Then given that the fire exists, then we
want to mitigate its consequences and so on.
MR. TRUE: I think what we said in the
fire section was that we felt fire suppression systems
were something that would be normally reflected in
fire risk analyses, and we could use this process.
But that if you were going to go --
CHAIRMAN APOSTOLAKIS: But what we're
screaming about this is you don't have that benefit,
right? It's screening analysis that is --
MR. TRUE: Well, we should talk about
fire, because --
CHAIRMAN APOSTOLAKIS: We will. We will.
MR. TRUE: And fire barriers like the door
you mentioned in general it's rare that a fire PRA
explicitly addresses those.
CHAIRMAN APOSTOLAKIS: Does not?
MR. TRUE: And so we said in order to do
a reclassification -- like as Mike said, the premise
is you stay where you are unless you have a case. And
so you'd have a case that said I've looked at this
barrier and even if it doesn't work, it doesn't
increase the risk and therefore it could be moved
down. But we don't see that as being a natural
fallout from importance measures, that would have to
be a focused look at barriers.
So we think the process could apply to
barriers, but we don't think a practical matter it's
going to be applied.
CHAIRMAN APOSTOLAKIS: Anyway, let's move
on because we are spending too much time. Shall we
jump into the questions.
MR. TRUE: Okay. I want to just jump to
one last --
CHAIRMAN APOSTOLAKIS: One last, okay.
MR. TRUE: One last thing on applications.
CHAIRMAN APOSTOLAKIS: Good.
MR. TRUE: Just so you understand where we
are.
Three of the owners groups -- that was the
last slide -- have pilot -- have undertaken pilot
applications of the categorization process and
guidance. And, in fact, in all cases developed
additional guidance that they've used in that process.
And they've looked at both safety related
and non-safety related, tried to get a balance of SSCs
removing different boxes.
The NRC staff has been involved in
observing the IDP deliberations on that. And we've
had a case where we've had a spectrum of PRA
information; fire approach is different, seismic
approach is. And we believe, and we'll talk more
about this when the pilots talk some more, we believe
that through that that NEI 00-04 is a comprehensive
and robust --
CHAIRMAN APOSTOLAKIS: Well, I wonder how
you can draw that conclusion? What exactly does a
pilot application tell us?
I mean, they take a document and they say
okay it tells us to categorize certain things in a
certain way. We do it and it works. We put them in
category 3. I mean, where the pilot tell me that this
was not appropriate or -- I mean, how can it question
the document?
It could question the ease with which the
document can be applied, but unless the panel that
evolved it, the panel comes back and says gee, you
know, everything you're telling us to do is nonsense,
which I don't think is the case.
So, I wonder --
DR. ROSEN: That can't happen because the
panel is the process in a lot of respect.
CHAIRMAN APOSTOLAKIS: Well, I don't know
how I can conclude it's comprehensive and robust.
DR. ROSEN: Oh, I agree. I mean, I would
be interested.
CHAIRMAN APOSTOLAKIS: I just don't know
that.
MR. HEYMER: We started and we developed
a draft guideline document. And some of the pilots
provided input into that. And then we took that
document and we took it into the field and we gave it
to people and said now can you use this document.
And so the real process is to test out the
document. And they started to use it and they
identified some problems.
The IDP actually had some problems in the
training process, and that's how we've gone through
the lessons learned.
We're not saying that Rev. B as you see it
today that was forwarded in June is the final
document. We need to make some adjustments and in a
number of areas. But the fact that the pilots took it
and they could understand the document, and that they
went through a categorization and identified
weaknesses or areas where we needed to improve it, but
they still went through it. And actually they came
out at the end. And as we went through the pilot
process, we've learned from the first and third look,
and the second. And I think what we ended up with
when you get to Surrey, admitting that we're going to
have to refine it some, shows that we do have a
reasonable and comprehensive process in place.
It's an evolution. It's to test a
document; did they understand the document, could they
use the document.
Bill, did you want to say anything?
MR. TRUE: No. Tom.
MR. HOOK: Having observed the Wolf Creek
IDP and participated in the Surrey IDP, as Adrian
indicated there were lessons learned in terms of some
small word changes to the evaluation criteria in the
NEI guide, specifically in section 5.2 in the IDP
guidance on addressing defense-in-depth issues for
candidate RISC-3 components.
Where I believe the Surrey IDP felt much
more comfortable with the new words and their
appropriateness to address their concerns from the
deterministic perspective from their areas of
expertise with those words then the Wolf Creek did and
probably the Quad Cities did. So I think there was an
evolution in the specific words that brought the IDP
to feel more comfortable with the categorization
process. Not as much with the active, because I think
the active didn't need as much revision, but the
passive in terms of the draft ASME code case underwent
significant revision between the Wolf Creek and the
Surrey IDP having reflected the comments from the Wolf
Creek IDP where basically it didn't work and they kind
of gave up on the passive categorization at Wolf
Creek. And Bob Lutz can speak to that more from the
Westinghouse perspective.
In terms of your asking the question about
well how does the IDP validate the process, I think
the IDP validates the process when the members feel
like the process works from their perspective, from
their expertise and their view of is it acceptable to
move this component for which I have some special
knowledge of from RISC-1 to RISC-3 or RISC 2 to 4, and
such.
And at Surrey I think the members felt
like they understood the deterministic basis as well
as the PRA basis for components being in their
categories much better than in the earlier IDPs.
MR. BURCHILL: Bill Burchill from Exelon.
I just wanted to add to that sort of
segueying off of your comment about I think you said
the IDPs won't revolt. In fact, and I don't want to
state this in too exotic terms, the IDPs in fact will
revoke if they do not feel the process is correct and
addressing the right issues.
The IDP panel members are not a randomly
selected group, of course. They're specifically
chosen for both their expertise and their experience.
And to be quite frank about it, they're very
protective of what they believe is the integrity of
that plant and particularly those coming from
operations, they're very protective. And so they do
not take at just face value what they're presented.
They challenge it. In every one of the cases of our
pilots it's been quite an experience. In one case it
was near revolt and they said your process needs to
consider the following things, your process must be
bringing me the correct information.
So, I think that it's been a real learning
experience for each of us that's been involved with
it. We've, of course, previously had the similar
experience with maintenance rule expert panels, but
now we're talking about actually changing things in
the plant, particularly leading to treatment changes.
And we are very strongly challenged by these IDPs.
DR. ROSEN: That experience is not
inconsistent with mine on the South Texas panel.
MR. TRUE: I'd expect that.
MR. CHEOK: George, I guess the staff has
also been present at these three pilots. And one of
the main staff comments was that there needed to be
more structure in the NEI 00-04 process and in the IDP
documentation as to what was deliberated. And I think
I agree with Bill and everybody else who said that
there's a lot of deliberations that goes on to be in
these IDPs and that they actually go through extra
lengths to try to determine that something is low
safety-significant.
What the staff's comment was that I think
we need to document this kind of process to ensure
that it does always happen in the future and that also
we need to document it in the present IDP
deliberations so that we can know what they talked
about and what the basis for when you something in
RISC-3.
So a lot of this process that's been
talked about is not now in documentation that we can
see, but we are pushing for more of this kind of
documentation to be present.
CHAIRMAN APOSTOLAKIS: Okay. Shall we go
to the questions?
MR. HEYMER: We provided a handout. We
weren't going to put these up on the screen. We've
got a handout. We were going to talk from these and
so it would be an interactive process between the
industry participants and the Subcommittee here and
with the NRC joining in.
So rather than put just the question and
that bullets up, the real purpose of the bullets is
just a summary, but it would be more of a discussion
session based on the questions as we go through them.
And I think some of them we've already got
into in partial manner. And I think going through the
exercise we've just done will help us.
Question 1: Why are there are four -- we
read this as to be why there are four categories
instead of three.
CHAIRMAN APOSTOLAKIS: That's what it
says.
MR. HEYMER: And, you know, when we
started this off this morning the NRC staff, we came
in with one proposal, the staff looked at it and said
perhaps it would be more practical to come up with a
quadrant approach and not have 50.49(b) as we did in
Option B to Appendix J, but have a separate rule. So
we took a look at the quadrants and we believed it
could work.
Now, we've evolved a little from that, but
I still think that a quadrant structure is correct.
I will note that as we get into the treatment area we
think that we're looking at three categories of
treatment as regards Appendix B stroke safety related,
augment quality and industrial balance of plant type
activities. And that balance of plant activities is
really a spectrum from items that you might work on as
regards to water cooler way up into something that
might be actually approaching the augment quality type
of activities for something that has significant
importance to the plant that may still be low safety-
significant.
So I think what we're looking at here is
not necessarily a hard line between RISC-3 and 4, but
more of a perforated line between 3 and 4. But the
categorization is still there because we're not
changing the design basis. We're still keeping the
nomenclature of safety related, and that means
something in the regulatory space. So I do think the
quadrant structure is practical. It does move
forward, but we are looking at -- I guess if we went
through Option 3 and we're successful in everything in
Option 3 that we're trying to go to, then perhaps we
would just end up with 2 categories. But we see that
the categorization is 4 with 3 degrees of treatment
and with the third section of treatment being
industrial balance of plant treatment being a very
much a graded process depending upon where you are as
regards to the importance.
But if the staff want to jump in there to
mention the quadrant process.
MR. REED: I don't disagree with anything
he said.
CHAIRMAN APOSTOLAKIS: Sorry?
MR. REED: I don't disagree with anything.
This is Tim Reed from the NRC staff. I
agree with his characterization.
CHAIRMAN APOSTOLAKIS: So Option 3 might
combine the two of them, but not Option 2?
MR. HEYMER: Right.
DR. ROSEN: That's just because of the way
we structured Option 2.
MR. HEYMER: That's correct.
DR. ROSEN: It has nothing to do -- I
mean, if you didn't have that, you would say that box
3 is -- we probably wouldn't have put the components
that end up in box 3 in box 3, would not have made
them safety related in the beginning if we had this
process.
After we designed the plant or as we were
designing the plant we did the PRA and IDP as part of
an integrated design process for the plant that would
have ultimately emptied box 3 into box 4.
MR. HEYMER: Right.
DR. ROSEN: And would have said okay,
these things are not risk significant, therefore we're
going to be treat them as nonsafety related.
MR. HEYMER: I think if you'll look at a
new plant, I mean I think you would probably look to
two categories, possibly three, but certainly I think
you would look at two. Because the fewer number of
programs you have the better it is from a long term
perspective.
But, yes, I mean if we were starting off
from scratch we probably wouldn't have the box 3
category.
DR. ROSEN: Well, the fact of the matter
is we're starting off from scratch. Because there are
some new plants being thought of by such companies as
Exelon and Dominion. So I think that -- if it's
revelation to anybody, that revelation might be
important in what those entities are doing.
CHAIRMAN APOSTOLAKIS: Anything else on
this question?
MR. BURCHILL: I was just going to
comment.
From a utility perspective it's actually
important to us to have the boxes 3 and 4 because
there are continuing regulatory requirements before
Option 3 may change them that apply to those RISC-3
components. And it's very important for the plant to
maintain cognizance of that and assure that they're
meeting those requirements.
So it really becomes a matter of
bookkeeping even if treatment really is the same
between the two categories.
DR. KRESS: That has to do with
functionality requirements?
MR. BURCHILL: Yes, in some cases.
DR. KRESS: Yes. Personally, I don't see
any downside to having 4 boxes. So, you know, it just
provides additional information as far as I'm
concerned.
MR. BURCHILL: Yes. And again, it's
almost a simple as mundane bookkeeping; the plant
being able to keep track of those components that they
have to maintain a continuing regulatory compliance.
DR. ROSEN: Those components which were
born safety related?
MR. BURCHILL: Correct.
DR. ROSEN: Which we now understand
probably shouldn't have been.
MR. BURCHILL: Absolutely.
DR. ROSEN: But we will continue to
maintain their functionality.
MR. BURCHILL: Correct.
DR. SHACK: Well, I always assumed that
the staff have some other -- you know, when we say
they're not safety-significant, they're not safety-
significant in terms of CDF and LERF. And it comes
back to these questions that Tom and Mario keep
bringing up about sort of frequency consequences and
some of the other things. And I look at this attempt
to maintain functionality in RISC-3 as trying to keep
a handle on those kinds of concerns without bringing
in a new metric.
And so I always assumed that the RISC-3
and the emphasis on the functionality there was really
part of a defense-in-depth frequency consequence kind
of consideration that wasn't explicitly brought in.
And if you said that CDF and LERF were your only
considerations, then I think you would end up with a
two bin system. But if you brought in explicitly other
kinds of measures, you would end up with in fact
something like the 4 quadrant box.
And that sort of one my questions that
came in here, as I looked through this, is suppose you
made the scope the same as the maintenance rule and
you brought in Part 100 considerations; the component
is used to meet those requirements and make that an
explicit part of the consideration. Would you
simplify some of these arguments over whether the
component has to be functional or not? And, you know,
you just automatically boost it up. Would it change
the scope all that dramatically?
MR. HEYMER: Tom?
MR. HOOK: For the passive component
categorization and the current draft ASME code case,
Part 100 is a consideration, just to address that
specific issue for pressure boundary components.
MR. HEYMER: Okay. Moving on. Question
2. Bill Burchill will start the response from the
industry perspective on this. Bill?
MR. BURCHILL: Yes. Actually I'm going to
respond to the next four questions which were
generally categorized in your letter as the use of CDF
and LERF as the sole criteria.
The first question asks whether there's a
logical inconsistency between the safety criteria used
in current licensing activity, specifically the
concept of frequency versus consequence and the
criteria used in Option 2.
And we took this quite literally in trying
to respond to it. We think that Option 2 is
consistent with other risk-informed applications which
we've previously talked about and in that sense
addresses more than just CDF and LERF. It does address
defense-in-depth considerations, preservation of
safety margin considerations and so forth.
But more to the question of the
consistency, I think sort of what I would say on
philosophic plane if you look at our current licensing
structure beginning with, I guess, Reg. Guide 1.70
Rev. 2 back in the mid-'70s, we articulated that there
was a clear distinction between those high frequency
events, relatively high frequency, anticipated
operational occurrence events and the limits that we
would place on them, you know, which are things like
DNBR and critical power ratio. And then the next step
down the curve would be those moderate frequency
events where we would then impose -- actually it turns
out it's similar limits to the AOOs. And then the
very low frequency events, normally referred to as
design basis events where we go to things like
Appendix K and more severe limits.
And our thinking is that in fact what
we're doing here is actually continuing the logical
extension of that curve that core damage and large
early release, neither one of which are associated
with any of those first three categories because they
disallow that as an end consequence, but now you
consider an end consequence that's more severe than
the most severe design basis accident consequence but
generally of a much lower frequency. You know, some
orders of magnitude in cases, but some coming close.
So if you think of the curve of the
frequency versus consequence as generally sort of the
Farmer line that was articulated almost 30 years ago,
that this is just a logical extension of that whole
concept. And as such, in fact, adds an enhancement to
our inquiry about the safety of the plant. You know,
it says I've got these three that are under design
base, they have a graduated set of criteria consistent
with the challenge frequency and we're now looking at
yet another point on that curve. And we're saying
for these events which have a much more extreme end
point, you know, generally we would expect to see them
in a much lower frequency.
CHAIRMAN APOSTOLAKIS: I'm not sure I
follow this argument. Couldn't there be a system or
a component that would prevent the minor release but
when it comes to serious severe releases, the system
is really irrelevant? Would that system come out as
being risk significant is CDF is my criterion? I
think the thrust of the question is that there may be
some SSCs that are really preventing minor releases,
Farmer called them "of nuisance value," and these may
not be captured. They may not be declared the
significant if you look at the severe stuff. That's
really the thrust of this.
I mean, there's no question that by going
to CDF and LERF you're going beyond design basis and
everything you told us is valid. But are we missing
some stuff that, you know, may be preventing minor
releases that may create an uproar or whatever by
focusing on the severe accidents beyond design basis?
MR. BURCHILL: I understand. I think
there's two parts to the answer. One is that under
Option 2 specifically we are maintaining the
functionality of those pieces of equipment.
Well, let me start with things that simply
stay in RISC-1. Things that stay in RISC-1 we're not
changing anything. So what we're really only talking
about is the subset that would be reclassified because
of safety-significant into RISC-3. And in those cases
we're compelled to maintain the functionality for all
of their design basis responses, which would be for
these less severe events.
Now, we're going to have a later question
that deliberates, of course, whether or not there's an
actual impact on that functionality or its reliability
with respect to treatment. The evidence generally to
date is, I guess, at best inconclusive on that, but it
doesn't indicate a strong change in the negative
direction. And, in fact, you know probably at best
neutral.
So what we believe is that being compelled
to maintain that functionality that we're supporting
the response to those less severe events and that
we're in fact not degrading that.
DR. KRESS: That presumes that the
original classification of those as safety-significant
captured their significance with respect to these
smaller releases.
CHAIRMAN APOSTOLAKIS: Is it possible that
some of them were not RISC-1?
MR. BURCHILL: Well --
DR. KRESS: And it's possible that they
didn't capture all of those because the process by
which they were -- the criteria used to put them in
that category might not have captured all of them.
CHAIRMAN APOSTOLAKIS: I mean the old --
DR. KRESS: We got a new way to do it now,
but --
CHAIRMAN APOSTOLAKIS: I understand. But
were they safety related in the old scheme?
DR. KRESS: Oh, yes. That's the reason
they're in that category.
CHAIRMAN APOSTOLAKIS: They were safety
related. Yes. All right.
MR. BURCHILL: Yes. Right. I mean if
they're safety related --
DR. KRESS: They were safety related. Now
that presumes the old process for determining they
were safety related caught all these frequency
consequence event components; that might be at the low
frequency nuisance level. I'm not sure they did. The
proof of the pudding in that is if you had a PRA that
looked at all those things and actually calculated a
frequency consequence and did a RAW with respect to
components on these lower frequency consequence
events. Had a RAW on the F-V.
And to me that would be a proof of the
pudding, and I'm not sure it's captured this way
because it has a presumption in it that they were
captured originally.
DR. ROSEN: Let me ask a question designed
to get very tangible about this. For example, what
did the PRA independent panel at Surrey do with things
in the waste gas processing system?
MR. HOOK: They worked in the scope of the
pilot where the Surrey IDP --
MR. BURCHILL: Well, they were at Quad,
the standby gas treatment system was one of the
systems chosen. And, in fact, through the measures
that were presented to the panel from the process of
their significance determination, it was recommended
that the system be reclassified into RISC-3. And the
IDP did not accept that. The IDP in fact -- you know,
I said about revolt. They rejected that information
and said we will not reclassify this.
DR. ROSEN: Here the IDP is standing for
defense-in-depth.
MR. BURCHILL: Yes.
DR. ROSEN: And just using their intuition
in saying --
MR. BURCHILL: Right.
DR. ROSEN: -- there isn't that much to be
gained from doing this and potentially something to be
lost, and we'd just rather not do it, so don't.
MR. BURCHILL: Precisely.
DR. ROSEN: And that's a familiar pattern
from experience with IDPs. Just because the process
allows it doesn't mean that the expert panel has to go
along. And so I'm glad to hear that response.
DR. KRESS: Let me rephrase my concern.
We have a category here called nonsafety related but
safety-significant. You have a category because you
did a PRA that said hey, we someone got this component
overlooked in the old process and that we really
should have been safety in there.
Now, what I was saying is if -- but that
was with respect to CDF or LERF. Now, if you extended
that concept to some low level frequency concept, I
was saying is it's possible we missed those, we might
have missed some other things. And the only way we
find it out is do the PRA. That was the nature of my
comment.
CHAIRMAN APOSTOLAKIS: So you're really
changing the argument. Billy was saying --
DR. KRESS: Just turn it around.
CHAIRMAN APOSTOLAKIS: -- that to go from
1 to 3 you have a functionality requirements and so
on.
DR. KRESS: Yes, exactly.
CHAIRMAN APOSTOLAKIS: But Tom is really
saying how about from 4 to 2.
MR. BURCHILL: That's an interesting
point. In fact, I want to address both the 1 to 3 and
the 4 to 2.
CHAIRMAN APOSTOLAKIS: Okay.
MR. BURCHILL: Because you could have, for
example, a component. In fact, the example Doug put
on his slide about the containment valves. You could
have -- you know, the vent valves. That's normally
under design base intended to close. Okay. And what
we've got is a situation that for the PRA we want it
to open. We want it to vent.
So whether or not that would be a
candidate for reclassification from 1 to 3, I'm not
sure. But we certainly would now identify a new
functionality, you know, because of this inquiry that
would have a set of attributes associated with it
which in fact may change the treatment of that
component; if nothing else to cause us to monitor its
condition and capability for this new attribute.
So I think -- I guess I don't see
something that degrades anything that's presently in
place. I think actually what we're presented is an
opportunity to identify new functionalities and
attributes that we really want to spend some time on,
you know, that we want to pay some attention to.
DR. KRESS: Yes. I don't think it degrades
anything presently in place either. I think there's
a potential for missing things that the current
process missed in the first place.
MR. BURCHILL: Well, actually now I
understand completely what you're saying.
DR. KRESS: Yes.
MR. BURCHILL: Yes. And we're going to
have to think about that. I don't think any of us
would stand here today and say we will guarantee this
process, we'll pick up those things that we might have
forgotten before. I don't think there's any -- we
would not -- yes, understand.
DR. KRESS: Yes. And that is the basis of
my comment.
DR. ROSEN: But there is guidance at NEI
00-04 that says if something like that shows up --
MR. BURCHILL: Yes.
DR. ROSEN: -- that becomes an opportunity
for the plant to exercise its 50.59 process.
MR. BURCHILL: Yes.
DR. ROSEN: And to make it safety related
to the extent possible and to recognize an error. I
mean, that's what the corrective action systems do
everyday.
DR. KRESS: Yes, but my point was that I
don't see in the process how you find those thing.
DR. ROSEN: Well, he's right. It's not the
process that does it, although there's a lot of -- the
process puts a lot of light and scrutiny on
components. And in that process you're naturally
going to find a cockroach if there is one.
DR. KRESS: It may very well, and I'm not
sure of that. It's not explicit.
DR. ROSEN: You're right.
CHAIRMAN APOSTOLAKIS: Okay.
MR. BURCHILL: Okay. The third question
had to do with somewhat of a variation I think of this
concept of the frequency versus consequence. And it
addresses explicitly the provision of layers of
protection which are part of the defense-in-depth.
And that these pieces are generally classified as
important to safety.
The implication of the question is that
we're going to change something that's going to either
change that level of defense-in-depth or eliminate it.
And our answer to that is that compliance with Part
100, you know, as the example in the question is is
not impacted by Option 2. In other words, we're still
compelled of course to comply with that regulation.
Neither are there layers of protection
explicitly impacted by Option 2. We don't anticipate
in fact that equipment is going to be removed from the
plant. The only thing that we understand would be
changed would be the treatment requirements, but we
must maintain functionality.
So there's not an expectation that we're
actually changing these levels.
DR. KRESS: There could be a potential for
changing the balance between CDF and LERF? You might
change CDF some and not LERF or vice versa? And
wouldn't that be a change to the defense-in-depth?
MR. TRUE: It's possible that CDF
theoretically could change more than LERF, but we are
controlling that amount of change to be a very small
change.
MR. BURCHILL: In both cases.
MR. TRUE: In both cases. So, yes, as a
matter of --
DR. KRESS: You're saying you're keeping
the balance within an appropriate range by keeping it
small?
MR. TRUE: In some appropriate range.
MR. BURCHILL: The reason I was a little
stumped on your question is I really wasn't thinking
of CDF and LERF as separate perimeters being an
illustration of defense-in-depth.
CHAIRMAN APOSTOLAKIS: But they are.
MR. BURCHILL: Yes, it's interesting.
CHAIRMAN APOSTOLAKIS: At the high level.
MR. BURCHILL: Yes. Yes.
DR. SHACK: So the argument in maintaining
functionality is not the same; although you have the
functionality if it works, the reliability could
potentially be degraded?
MR. BURCHILL: Yes.
DR. KRESS: That's why a RAW tells you.
CHAIRMAN APOSTOLAKIS: Well, that's what
the whole issue is here, right?
MR. BURCHILL: Okay.
DR. SHACK: To come back and say that
you're maintaining functionality just doesn't really
address the question in a sense either. We're
changing the requirements. Now whether they have a
significant impact is a different -- that's a
different question.
MR. BURCHILL: But that in fact --
DR. SHACK: Which, of course, is the
relevant question.
CHAIRMAN APOSTOLAKIS: Was not even a
question.
MR. BURCHILL: Yes, it was a comment.
CHAIRMAN APOSTOLAKIS: Just an argument
supporting the other question.
DR. KRESS: Yes, you're right.
CHAIRMAN APOSTOLAKIS: Which were number
2 and number 5, I believe. 2 and 5 have question
marks at the end. Three and 4 really are preludes to
the questions.
Anyway --
MR. BURCHILL: Let me just use the
opportunity with question 4, however, even though it's
not posed as question --
CHAIRMAN APOSTOLAKIS: Yes. Yes.
MR. BURCHILL: -- to clarify that we are
not addressing within this Option 2 arena the spent
fuel pool and the fuel handling systems. It says rad
waste systems. In fact, we are doing some of that,
but it's principally the spent fuel pool and fuel
handling are not explicitly under the scope of this.
We've talked about this functionality item
and defense-in-depth, so unless there's a question on
4, we'll go on to 5.
MR. PARRY: Well, yes. You conclude the
response to 4 by saying there's no conclusive evidence
that a "'category-one quality requirements' actually
provide improved SSC performance." I mean, I think
that's true. I guess I would ask is there conclusive
evidence that they don't provide improved SSC
performance?
MR. BURCHILL: Well, I mentioned
previously that I think our position is clearly there
is not conclusive evidence. However, probably the
most extensive body of evidence that we're aware
that's actually attempted to provide this comparison
was submitted on the South Texas docket in their
exemption request. And I'm failing right now to
remember the exact number of components, but it was in
the 20,000 range, I think. I may have that figure
incorrect. But it was a large number that were looked
at with comparison between those that had been
maintained under a safety related regime and those
that had been maintained under a commercial practices
regime. And that document pretty clearly shows
there's no statistical bias one way or the other.
Now, there's been argument about whether
the conditions that were imposed were sufficient to
test the case and so forth. But at least the evidence
we're aware does not indicate a degradation in a
systemic bias way.
Okay. Number 5 is a difficult one. It
says: How does the ensure of SSCs that are deemed
risk significant not essential for addressing acts of
terrorism and sabotage? How does that get addressed?
We're looking at the potential for
radiological release under the LERF consideration.
But we do not under this program explicitly address
acts of comission or sabotage or terrorism. We
consider those are specifically addressed in a
structured way under the security programs and we
don't see that anything that we are doing here would
actually change that. There's no linkage across to
how the security program addresses preparation for
that type of an impact on the plant.
The programs, as I say, are not within the
scope of Option 2. The one place which you may be
aware that the PRA does get applied, we do assist
occasionally in the security program in identifying
what are called target sets of equipment. You know,
those that would present the plant with disabling
effect and therefore might be the focus of a sabotage
or terrorism activity. But there's nothing about what
we're doing under Option 2 that would change that
activity or dilute the information that's being
presented in support of the security program.
To be frank with you, I think what we
could come up with as an answer on this one, because
it's not considered under this, Tom, did you have a --
MR. HOOK: Yes. I just wanted to make one
point. That in the target sets for plants there are
nonsafety related components in the target set. So
it's not a presumption that something's credited for
sabotage and terrorism is a safety related component.
So that dispels the concern about moving something
from RISC-1 to RISC-3 as having an impact in terms of
the expectation of its quality requirements for
mitigating terrorism and sabotage events.
MR. BURCHILL: Right.
CHAIRMAN APOSTOLAKIS: Well, maybe this is
a good time to take a short break.
So we will recess until 10:15.
(Whereupon, at 10:10 a.m. a recess until
10:2 a.m.)
CHAIRMAN APOSTOLAKIS: So we are now on
question 6. So whose going to respond to that?
MR. HEYMER: We discussed as we went
through sort of an overview of NEI 00-04 the PRA
quality and we had some discussion there. And we
thought that it would be worthwhile as we're in this
question and we've covered some of these issues, that
we would ask the pilot plants to speak to how they've
dealt with this issue as they've gone through Option
2. And so, Tom?
MR. BURCHILL: Yes. Actually I think it's
a little bit broader.
This is Bill Burchill with Exelon.
A little broader than just pilot plants.
I'm going to really try to speak to this from a
broader utility perspective.
There's a lot of focus in the PRA quality
area that's been placed on the peer review process and
the certification of PRAs as the measure of quality or
perhaps the ASME standard or other standards that
under development as the majors to be applied. And I
want to step back from that a little bit and talk
about really how do you get quality in a PRA. Those
two tools are certainly measures that are applied when
a PRA exists and somebody wants to come in and
evaluate it or the utility itself wants to evaluate
it. But there's a much bigger picture on what
produces PRA quality, and I'm going to try to speak to
that and then Tom Hook is going to provide some other
specific examples.
I think in today's environment where we
are using PRA extensively for risk-informed
application and daily, in fact, hourly perhaps in A4
support under the maintenance rule, that the first
thing that one has to have to ensure quality is a well
structured PRA program.
And what I mean by that is PRA, we've
joked about this over the past few years. PRA has
come out of the closet. You know, it's now a -- you
know, we don't even call it PRA in at least Exelon
anymore. We call it risk management. And it's a
function that is right along side design engineering,
system engineering, the maintenance function,
operations function. It's a recognized function and
it's governed by processes and procedures just as
other functions in the operation of the plant.
So a well structured program, which I
think one will find in all utilities today, is the
first starting point.
That process has to have internal process
controls. Certainly as recently as even four or five
years ago if you went to a utility and looked at the
degree to which the way one goes about doing the
preparation of a PRA or its documentation, you might
find a less satisfactory condition than you would
like. Today I would tell you that when you go out to
utilities they either already have in place or are
rapidly developing very highly structured procedures
and guidelines for everything they do, and
particularly those areas that are already in
continuing use like the maintenance rule A4, those are
all highly structured; the interface between the PRA
function or the risk management function and the
operations group and the work planning and work
control or work management group is very well defined.
I think the third hallmark is you have to
have a highly component PRA team. You cannot do what
we're doing today with PRAs with amateurs. The people
that are on the PRA team on the risk management group,
they have to demonstrate their capability. And I know
that in Exelon and I believe this is becoming the
practice, these people are certified just like other
engineering disciplines. We have, in fact, seven
different certification guides that each one of our
risk management engineers must demonstrate their
competence. You know, it's like a qual. process. So
I think that leads to PRA quality.
The fourth is what I will call the
documentation area. The improvements that have been
made, certainly post IDP and very strongly driven by
the certification process have forced utilities to
really seriously think about the degree and extent and
quality and traceability and retrievability of the
documentation that goes along with their PRA. And I'm
not talking just about what's written in a paper, but
you know what decisions were made in developing of
entries, fault trees, you know, approaches to human
reliability analysis, whatever. Those are documented,
those are retrievable.
You mentioned earlier, Dr. Apostolakis,
that several of the PRA codes can provide the
uncertainty analysis. Well, likewise they can provide
documentation. There's automated tools for ensuring
that those thought processes that are used to develop
a PRA are captured.
We all I believe have a process of
requiring ourselves to do periodic PRA updates. We
have varying cycles on that, but the ASME standard, as
you know, also compels that a periodic determination
of the adequacy of the PRA to meet the representation
of the as-built/as-operated plant is required.
And we also do unscheduled updates. If we
have any modification in our plants, every
modification in fact is evaluated for risk impact from
two perspectives. One is whether or not the
modification itself changes the risk of the plant and
if so, that we recognize what the impact is. But also
whether as a result of that modification the PRA
itself must be changed so that for its other
applications, you know, for example again A4, that
that PRA adequately represents the plant.
So, we will have unscheduled updates to
represent some specific either design change or
procedure change. We will also then periodically go
back and check the whole PRA and literally go in and
check everyone of the 11 elements.
Now, as far as the risk management
engineer himself and how does he assure that the tool
that he's using or that he's improving is adequate,
one technique is something I'll just call
reasonableness checks. I mean, there's a wild wealth
of information today about PRAs. I mean, we're not
functioning with one or two studies. You know, every
utility has, and we're talking specifically full power
internal events but we could be talking the other risk
sources where those exist at different utilities as
far as their quantification tools.
There's a lot of peer checking that can
take place by just the individual risk management
engineer. There's a lot of documentation of how other
plants of similar design, similar vintage, similar
equipment, how they have been assessed with respect to
their risk profile. And so the first point in a
reasonableness check would be, obviously, to go out
and see how does the result you've generated compare
with what others have found.
We do a series of acceptance reviews that
can range from a second risk management engineer
sometimes who, depending upon the nature of the
development, is totally independent from the
development process or to even bring in an outside
party and review our PRAs. This is even before we
would go to a certification team.
I don't want to represent to you that we
do that in each and every change, but depending upon
the magnitude of the change if we had a significant
update to a PRA, it's more than likely we would bring
in another party to look at our work and see whether
or not that was adequate.
Another point is, and this is certainly
true at all utilities today, we all have significant
management oversight of the application of our risk
management tools. Again, PRA has come out of the
closet. We are no longer a little study group off to
the side where, you know, it's a study, it's nice, we
look at it and it produces pretty pictures with pie
charts and we put it on the shelf and don't pay too
much attention to it anymore. It is now used
everyday. It influences work planning. It influences
the operation of the plant and management pays
attention to those things. Management wants to know
that those things that are influencing that plant's
operation are sufficient.
Now we'll come finally at the end of my
list to the PRA peer review and certification process,
and the use of standards.
I think what you can see that I'm trying
to develop is that those things when they're applied
will only be successful in showing that the PRA is
adequate if all these other attributes have been met.
In Exelon we have ten sites, literally 17
PRAs for 17 operating unit, and we've had them all
through certification. I can tell you it's a fairly
grueling experience. And I can't imagine that those
would have been successful in not only measuring the
PRA, but in developing a favorable impression of their
capabilities if we hadn't done all of these preceding
activities that I've described.
What shall I say? I'm not trying to just
be rah-rah about it. This is a very serious business.
It's an integral part of the plant's operation today,
and it's taken quite seriously and, therefore, it is
now integrated into the main fabric of the overall
engineering operation.
I can tell you personally that my MBO --
we don't call it that -- for the past 2 years,
actually 4, but particularly for the past 2 has had a
very strong point in it about bringing the risk
management activity into the mainstream of the
engineering department and the overall nuclear
organizations activities.
I'm going to turn it over then to Tom Hook
who can give some more specific examples.
MR. HOOK: I just wanted to talk about
Surrey and North Anna and Dominion's PRA quality
attributes that we think makes the PRA suitable for
use in an Option 2 type application.
Now, first of all, a plant that
participates in license changes through Reg. Guide
1.174 already has to address the quality attributes in
the Reg. Guide in terms of the design meeting the --
of the models being consistent with the plant design,
the quality of the PRA staff, the peer review having
been performed. So most plants having submitted Reg.
Guide 1.174 license changes already meet the quality
attributes of that reg. guide. And Dominion has a
living PRA program to ensure that it can continue to
support Reg. Guide 1.174 type submittals at anytime.
The second attribute that Bill touched on
that I think is very important for ensuring quality
for my experience having worked in expert panels for
the maintenance rule of two different utilities, is
that there is a questioning attitude during the
categorization process that occurs for the maintenance
role. And many of the modeling problems that occur or
inconsistencies with the plant design are uncovered
during the maintenance rule review process, and that
was very helpful at North Anna and Surrey in upgrading
the quality of the PRA model.
Surrey and North Anna also were involved
in the risk-informed ISI and performed full scope
class 1, 2, 3 ISI expert panel process and looked at
a large scope of components independently in another
expert panel and obtained a significant amount of
comments and feedback, and PRA quality improvements as
a result of the exchange.
Then through the NEI certification process
PRA review there were additional comments that come
back from outside observers through --
CHAIRMAN APOSTOLAKIS: These comments,
Tom, I mean, you're using a failure rate, for example,
is that a distribution that you are using typically or
a point value and is anyone questioning whether that
value's reasonable? I mean, how does that work?
MR. HOOK: Those types of questions
typically do not come up unless there's -- it's point
estimates. in general. And only -- the expert panel
focuses more on the dependencies in the model and the
accident sequence analysis than on failure rates
unless the failure rates look totally inconsistent
with expectations.
CHAIRMAN APOSTOLAKIS: But, I mean, I
don't even know how these expectations are formulated
when you talk about 10 to the minus 3, 4, 5. I mean,
it's not something that we have some intuition about
that the failure rate should be this. I mean, we are
looking at all these studies for a number years and
then we say, well, gee, I expect it to be in the 10 to
the minus 4 region.
But I'm really curious about that. I
mean, we keep talking about failure rates and point
estimates and so on. And I don't know where they come
from and whether anybody questions them, or you know,
why not use a distribution and is there a population
of distributions out there that are reasonabler. And
it's not just the failure rates. I mean, human error
rates. And then the dependencies between human
actions and so on. There are so many places where a
factor of 2 here, a factor of 1 or a half there, you
know, pretty soon we're talking about serious factors.
And I don't know that anyone really looks at these
things in a critical way.
Now, for some reason I'm under the
impression the independent panel will not do this,
even though they have a PRA expert on them. And it
bothers me. I don't understand. I mean, and then we
propagate those point estimates, we don't know what
we're getting out of it. I'm pretty sure these things
work fairly well, most of the time. What I'm
complaining about is that I haven't seen a systematic
analysis or study that shows that they do actually
work.
I don't know doubt that what you're
proposing most of the time will give reasonable
results. But in terms of building and maintaining
public confidence, it seems to me that somebody ought
to look at this thing and say yes it doesn't matter;
that if you use the standard point estimates that
people use, you are going to get reasonable Fussell-
Veselys and RAWs and, you know, that in combination
with the expert panel questions will lead to
reasonable results. But I haven't seen that, and I
don't know.
I mean, somebody says, yes, I'm going to
use 5 10 to the minus 3 and another guy says no, I'll
use 10 to the minus 4. What's the basis for that and
what do I get out if a complex system like a PRA? You
know, we know from the theory that inputs that are
points estimates, so you don't know what you get out.
If they are mean values, that is you know.
And then we declare them as being mean
values without any basis, in my view. Why should the
number be a mean value just because we say so? And
that bothers me.
Again, I don't think it's something that
will really turn everything you are doing upside down.
No. I know it won't. What really drives these things
is model uncertainty. But why don't we take care of
the stuff we know how to take care of so we don't have
this feeling that what we're doing is okay? I mean
the reactor safety study 30 years ago did do that.
MR. BURCHILL: I was just going to clarify
that I agree with you. I don't think that the IDP is
going to delve into this. It's not their mission nor,
frankly, would they have the time or expertise other
than their particular member from the risk management
group. Certification teams do.
Certification teams are renowned for being
quite challenging on the data sources that you use;
whether or not they are recognized in peer review data
sources, are they up to date, do they account for --
and I'm talking about generic sources now -- and then
I believe that it's fair to say that they also
challenge if you do not have plant specific data
considered, if you've not upstated your data source,
why have you not. And they will challenge has there
been any known trend. The first thing they'll
challenge is you do you know the trend in behavior of
your components with respect to their reliability.
and then they'll challenge whether or not if there has
been anything that would indicate deviation from your
prior, so to speak. Have you taken it into account?
CHAIRMAN APOSTOLAKIS: But, Bill, that my
concern. Do people do this on a routine basis? I
mean, when we pick up a PRA and somebody has used it
in Option 2, they have done a categorization and they
use point values, what assurance do we have that these
point values are plant specific and that they are
indeed mean values? Do we have an assurance there?
I mean, are they under any obligation to show us how
they did that?
I remember some of the IDP, you know, some
were very good. They used the standard methods to
update and so on, as you know. But others, I remember
one said oh for events for which we felt we didn't
have significant plant specific information, we used
generic sources only. For other the others we just
used the plant specific data. And you scratch your
head and say, first of all, how did they decide that
they didn't have significant plant specific
information. And then why this arbitrariness? I
mean, we know how to handle these things.
And I think if we did that in this
document, then a lot of the concerns about the
sensitivity analysis would go away. And, in fact,
what you told us earlier, Doug, is the way to do it.
Do a sensitivity analysis on major model
uncertainties, not playing with a point decimal
lambda. Who cares?
You're spending money on the pilot
studies. I mean, would it be really an extraordinary
expense to add a short study of several months showing
to us that these things are handled well or they're
relevant, or it doesn't matter? I don't understand
that.
MR. TRUE: To me it's somewhat of a semi-
infinite problem.
CHAIRMAN APOSTOLAKIS: In it not infinite,
no.
MR. TRUE: Because the situation that
exists in most plant specific PRAs is that a large of
portion of data is taken from generic sources and the
mean value from that generic source is used as a point
estimate in the calculation.
And then for dominate by some definition
or important by some definition, important components
plant specific data is collected and then used to
update that generic information to reflect more plant
specific evidence.
The peer review process will look at all
pieces of that and say is the generic source you
started with a reasonable generic source --
CHAIRMAN APOSTOLAKIS: Well, if they did
what you just described. I'm not sure they always do
that. Do they really take the mean value of the
generic distribution as a point value?
MR. TRUE: I think the peer review team
would have a hard time if you didn't do that. I think
you would get criticized for that in your peer review.
There may be --
CHAIRMAN APOSTOLAKIS: And the issue may
not be so much the hardware, how about the human error
rate?
MR. TRUE: Well, the human errors are,
obviously, one of the most difficult portions of the
PRA to even compute and assign a probability to, much
less have confidence that we have a true mean value of
that parameter. In most cases --
CHAIRMAN APOSTOLAKIS: Well, let me let
you know where I'm coming from. The Fussell-Vesely in
RAW are uncertain, aren't they? I mean, if the
Lambda--
MR. TRUE: Yes.
CHAIRMAN APOSTOLAKIS: Is there a simple
analysis someplace, some study that shows that the
categorization is not effected by these uncertainties
the way we're doing it now or was it a figure in the
old paper by Cheok and Parry and Sherry that showed
the some evidence that indeed for a lot of the
components it doesn't matter unless the uncertainty is
very, very large. But wouldn't the more systematic
study show? I mean, there is a paper in the
conference in '96 in PSA where a couple guys from
Maryland did a similar thing.
You know, document that it doesn't matter,
that the uncertainty's not something I should worry
about rather than saying use point estimates and do
it, and then the expert panel really will take care of
it.
I think it probably doesn't matter,
actually. But I would like to see that it doesn't.
MR. TRUE: I think one of the problems --
CHAIRMAN APOSTOLAKIS: Just once.
MR. TRUE: I think such a study might have
some value and give us some more confidence. But the
importance measures are really screening tools to try
and bring in the components and --
CHAIRMAN APOSTOLAKIS: Yes, but screening
tools are supposed to be conservative. How do you
know they are?
MR. TRUE: Well, how do we know that 2 and
.005 are the right thresholds?
CHAIRMAN APOSTOLAKIS: Well, that was
another question that would be raised. Yes, don't
assume we know.
DR. ROSEN: You can't go much lower than
those numbers. I mean in terms of setting thresholds.
Those are almost where we are before we started this
exercise. I've characterized them as extraordinarily
timid. You know, how low can you go. You could go to
a one.
CHAIRMAN APOSTOLAKIS: 1.8.
DR. ROSEN: Yes, you could go to 1.8, you
could go to 1.0. But we're talking about individual
components that have a RAW of 2, this is --
CHAIRMAN APOSTOLAKIS: I just don't
understand this reluctance to actually demonstrate
once and for all that what we're doing makes sense
instead of having to take it as an article of faith.
That's all I'm saying. I need one cross mark. We're
not talking about a million dollar study here. It's
some experience guys like you can do it very quickly.
MR. TRUE: I think that the --
CHAIRMAN APOSTOLAKIS: How about that?
MR. TRUE: I'd be happy to do a million
dollar study. No.
CHAIRMAN APOSTOLAKIS: And then we play
with the sensitivities and, say, take all the failure
rates, put them in the 95th percentile. Hey, come on,
now. Come on. This is not a sensitivity study worth
its name. A sensitivity study should look at model
uncertainties and say, you now, we have some
uncertainty there, we really don't know how to handle
it. But, look, if we do this and this and that and
play some sensitivity games, we get this warm feeling
that, yes, we are not off.
MR. TRUE: We'll get to the sensitivity
studies in another question. Yeah. In some year we
will.
I think we may learn something from such
a study, but as Steve said, these thresholds are
relatively tight already to begin with. And they're
going to be screening in a very large fraction of the
components that are modeled in the PRA as safety-
significant. It's not like we've set bounds very far
out and we're worried about already missing things.
And then on top of that when we do the
sensitivity studies we'll talk about in a little
while, we're even bringing more components over those
tight thresholds into the screening process. And I
think if anything, we are probably being conservative
in bringing in all the different --
CHAIRMAN APOSTOLAKIS: But you say we're
probably being conservative. I don't know that.
MR. TRUE: Well, I don't know how to prove
that we are --
CHAIRMAN APOSTOLAKIS: Well, you could.
MR. TRUE: -- or that we are being
realistic or conservative in this.
DR. KRESS: It has to be done on a plant
specific basis.
MR. TRUE: Because it's really specifics
of the plants and more so to the modeling assumptions
and things that go into the model than the parameter
estimates.
CHAIRMAN APOSTOLAKIS: That's why one does
studies like that, to show that the process is
conservative or at least reasonable results. The fact
that it may be difficult to prove it 100 percent of
the time doesn't mean that you shouldn't try.
MR. TRUE: I guess I don't know if I did
a study like that what the acceptance criteria would
be for the result. Is it that nothing changes? Is it
that --
CHAIRMAN APOSTOLAKIS: I don't know, for
example, if I actually propagate the uncertainties to
Fussell-Vesely how much probability will be above the
.005 or not. I don't know that. I suspect most of
the probability will be above for the components you
are declaring as RISC-1. I don't know how much. You
know, I haven't done it myself. I don't know. And
RAW, the same thing. I mean these things are
uncertain.
DR. KRESS: But the problem is a RAW of 2
means something for one plant in terms of its effect
on CDF and something entirely different for another
plant.
CHAIRMAN APOSTOLAKIS: That's another
problem, yes.
DR. KRESS: And --
MR. TRUE: Relative importance measure
are--
CHAIRMAN APOSTOLAKIS: Yes, they're
relative.
MR. TRUE: They're around the base value.
And so a plant with a low CDF and a RAW of 2 has a
much smaller absolute impact on risk than a plat with
a higher CDF would have.
DR. KRESS: Yes, and I find that to be a
problem. You know, that's penalizing the good plants.
MR. TRUE: Well, I think that it reflects
a desire to stay within the basic framework you have--
DR. KRESS: You know, it's just like 1.174
in a sense, but that's penalizing the good plants in
my mind, and it's treating them unfairly. You know,
I think -- I'm saying that the thresholds ought to be
plant specific. They ought to have something to do
with their effect on CDF. You ought to incorporate
the uncertainties because you need to have some -- the
uncertainties will be different for different plants
and you need to have a consistency in the confidence
level that you want to meet these thresholds.
And, you know, it's just not coherent to
say we'll use 2, and that's it for an example.
CHAIRMAN APOSTOLAKIS: For example --
DR. ROSEN: You're requesting a revision
to 1.174.
DR. KRESS: Well, I've been suggesting
that for a long time.
CHAIRMAN APOSTOLAKIS: Well, let me -- if
you do a study like the one I mentioned, one of the
things that you may want to investigate is defining a
new RAW, RAW STAR, which is the ratio of the numerator
as we do it now, you know, increasing -- actually it's
a denominator -- increasing the unavailability to 1
and calculating the new CDF, but the reference value
now will be perhaps 10 to the minus 4. The goal, now
the base CDF. And see what happens. Then you are
moving more to a more absolute measure.
DR. KRESS: Yes, that would incorporate my
problem then. Yes.
CHAIRMAN APOSTOLAKIS: See, studies --
when I say studies, I don't mean just propagate
uncertainty. I mean if you start investigating the
whole analytical basis of the methodology, and then
you could come up with questions like that. Would
that be reasonable? I'm not saying it will be, but
here is a possibility that would answer this question.
DR. KRESS: That would answer my question.
CHAIRMAN APOSTOLAKIS: Why use relative
values for all the plants when, in fact, again we have
a paper from distinguished members of the staff here
that say that you should not be using these things, as
I recall.
MR. PARRY: Can I chip in here, since
we've been referred to? This is Gareth Parry again.
CHAIRMAN APOSTOLAKIS: Oh, you heard
distinguished member and you felt --
MR. PARRY: No, I heard mention of a
paper.
Remember that these -- and what's Doug or
Bill said -- that these criteria for RAW for Fussell-
Vesely are in fact only screens.
DR. KRESS: Yes.
MR. PARRY: The ultimate test, and you'll
see it in NEI 00-04, is the absolute value of delta
CDF and delta LERF.
Now, yes, you could change the RAW and
Fussell-Vesely thresholds on a plant specific basis,
and actually if you read Appendix A of Reg. Guide
1.174 you'll see we suggest it. But in a way, does it
matter that much if in the end you're going to do this
final test on delta CDF and delta LERF? It's a step
to the final categorization --
DR. KRESS: That just confirms that the
choices you made didn't do it.
MR. PARRY: Yes.
DR. KRESS: But you might have been able
to put a lot more things in different categories.
MR. PARRY: Oh, you might have been able
to put a lot more, yes.
CHAIRMAN APOSTOLAKIS: But the thing that
bothers me, Gareth, is that we are saying or we're
asking ourselves does it matter that much too many
times. Where do you draw the line? When does it
begin to matter?
It doesn't matter that we don't have a
structure IDP process whereas SDP did. It doesn't
matter that perhaps the factor by which we increase
the failure rates is 2 to 5 rather than 10, as SDP
did. It doesn't matter that we don't do an
uncertainty analysis. Nothing seems to matter.
MR. PARRY: Actually --
CHAIRMAN APOSTOLAKIS: I don't know when
we'll have to worry about the things mattering
anymore.
MR. PARRY: Right. I don't think that's
true. And I think when we get to --
CHAIRMAN APOSTOLAKIS: Oh, come on.
MR. PARRY: And when we get to discussing
these issues later on, I think you'll see that they do
matter.
CHAIRMAN APOSTOLAKIS: Every single one
that I mentioned is true, isn't it? They're proposing
2 to 5 now, not 10.
MR. HEYMER: I really --
MR. PARRY: Well, they're proposing that.
MR. HEYMER: -- struggle with the word we
do not have a structured IDP process.
CHAIRMAN APOSTOLAKIS: Well, I don't see
it in the document.
MR. HEYMER: And we recognize that, among
other things that the pilot plants identified, is we
must give it more structure.
CHAIRMAN APOSTOLAKIS: Oh, okay. Well, if
you're talking about something that has been improved
and changed, that's a different story.
DR. ROSEN: Well, that comes to one of the
base questions. You guys are going to have to come
back, is that right?
MR. HEYMER: Yes. This is not the final
product. We've got to --
DR. ROSEN: You agree it's not your final
product.
MR. HEYMER: Right.
DR. ROSEN: It's a work in progress.
MR. HEYMER: It's a work in progress. It
was put out there for the pilots to take and test and
we recognize that in some areas, like in the IDP
guidance, it needs to be strengthened. And we're
going to do that. We've got some comments from the
staff to incorporate. We've got error insights from
the IDP and the process. And then we've got the
staff's comments to incorporate. And then we'll be
forwarding that back for sort of Rev. C.
DR. ROSEN: Well, maybe you ought to also
look at what the staff is planning to do with the
regulations in 50.69. Because there's no Appendix T
anymore and yet B refers to an Appendix T.
MR. HEYMER: Right. Well, Rev. B was
written in May last year when Appendix T was
breathing. And now it's now. So, I mean, you know
there's certain things that we need to adjust.
We are at an interim stage.
CHAIRMAN APOSTOLAKIS: Right. But I get
the impression that both the staff and you feel that
a lot of things don't matter, but I feel they do. Or
at least I'm asking -- no, I'll take that back.
What I'm saying is just demonstrate that
they don't matter. Please take the time to
demonstrate they don't matter.
MR. HEYMER: Or have a basis for the w to
5 as opposed to --
CHAIRMAN APOSTOLAKIS: Yes.
DR. ROSEN: And to be fair, George, I
think we have to give the staff it's chance to tell us
what they think about this document. We haven't done
that yet.
CHAIRMAN APOSTOLAKIS: No, they are
supposed to jump in whenever they disagree with the
industry is saying.
DR. ROSEN: Oh, they are? Okay.
CHAIRMAN APOSTOLAKIS: That's what they
told me, right?
MR. REED: We haven't got to the specific
item yet.
CHAIRMAN APOSTOLAKIS: Yes. They're not
going to have a separate presentation. Just jumping
in. Silence means concurrence.
DR. ROSEN: No. I think what Tim Reed
said was, Tim said they hadn't gotten to the specific
issues yet.
MR. REED: Well, some of the specific
issues are concerned with the IDP, we're not to that
yet. We're not to the particular question yet, and
then we'll jump in.
MR. MOIENI: George, this is one of the
reasons --
CHAIRMAN APOSTOLAKIS: You have to speak
to the microphone.
MR. MOIENI: Oh, sorry.
CHAIRMAN APOSTOLAKIS: That way you have
volume and identify yourself.
MR. MOIENI: I don't know how to change
the volume. I don't know yet.
CHAIRMAN APOSTOLAKIS: You don't know who
you are?
MR. MOIENI: This is Parvis Moieni.
CHAIRMAN APOSTOLAKIS: Okay.
MR. MOIENI: I think I have a response to
at least the criteria, where we draw the line.
Because we did the risk-informed IST a couple of years
ago, the criteria for Fussell-Vesely was .005 or
1.005. And when we did the exercise and identified
the low safety significance, pumps and valves, to
basically increase the interval. While testing
interval we realized with that line we could not meet
the criteria in 1.174 on the delta CDF and LERF. So,
one of the options was not to do anything or basically
to stay with whatever we did in terms of having low
safety significance, or go back and revisit the
screening.
So to make a long story short, we reduced
it to .001 in order to meet the criteria for the delta
CDF and later LERF. So even though the code case in
ASME said .005, we used .001.
So this is a response to your question
that we really, even back then, we didn't know that
this came from the Bible and said this, this is .005.
So we had to change it and redo the categorization,
redo the Fussell-Vesely and RAWs and some of the low
safety significance went back to --
CHAIRMAN APOSTOLAKIS: Well, that's the
kind of thing that I would like to see, that's a
sensitivity analysis that I would like to see in the
study that I'm proposing. You know, how sensitive are
these things?
And now when you tell me you reduce it by
a factor of 5, right?
MR. MOIENI: Yes.
CHAIRMAN APOSTOLAKIS: From .4. That
brings up again the issue of uncertainty in the
importance measures. Does that go completely outside
the distribution of the Fussell-Vesely. I don't know.
I've never seen any study like that.
I'm sure you guys are doing things when
things don't work out the way they're written in the
documents. But why would it be, you know, so
difficult to do a study that looks at all these things
as says, look, there are certain conclusions that we
can draw and certain approximations that are valid
most of the time, and let's go ahead and use them.
I mean, when the reactor has proposed
approximations like the prompt jump on approximation
and all that stuff, they actually documented that they
were approximations. Why can't we do the same thing
in PRA? And I'm sure in other sciences like material
sciences they do similar things.
DR. KRESS: No, that's exact.
CHAIRMAN APOSTOLAKIS: Anyway, I think you
got the thrust of the comment here.
DR. ROSEN: Could I ask a question on a
slightly different subject here, and that is that
there is something in 00-04 that leads me to the
conclusion that if the independent panel decided that
they wanted something to be in not safety-significant,
that they couldn't just do it, put it in not safety-
significant no matter what the PRA said?
It seems the independent panel can
override the PRA results. There's no specific
expressed prohibition against that that I see.
MR. TRUE: It can only move it up. It
can't -- the IDP cannot move down.
DR. ROSEN: Can you point to where that
says that in here?
DR. SHACK: It doesn't say that.
DR. ROSEN: No.
DR. SHACK: It says it can move it down.
CHAIRMAN APOSTOLAKIS: Yeah, in fact, that
was one of my questions. I saw it somewhere. I don't
remember where now. But I remember SDP said that --
DR. SHACK: Right. SDP --
CHAIRMAN APOSTOLAKIS: -- the panel can
never bring it down. But in your documents I think
they can do it.
MR. TRUE: I think they can only do that
if there --
CHAIRMAN APOSTOLAKIS: Now, where did I
see that.
MR. TRUE: -- is a set of circumstances.
DR. SHACK: Yes, they have to justify it,
but they can do it.
MR. TRUE: This flow chart is intended to
reflect --
CHAIRMAN APOSTOLAKIS: Ah. On page 6 of
the letter to Mr. Pietrangelo by the staff, question
7 says there is a need to provide guidance about what
authority the IDP has for making a determination that
an SSC is low safety-significant when the PRA
indicates the SSC is safety-significant. So I'm sure
the staff had some basis for writing this.
MR. TRUE: What this flow chart shows --
DR. ROSEN: Perhaps could be focused a
little bit.
DR. SHACK: It's on page 29 it's the "if"
statement.
CHAIRMAN APOSTOLAKIS: Okay.
DR. SHACK: If the IDP determines that
this in many cases special treatment will have low or
no impact on such SSCCs, which meet the criteria, if
the IDP terms this is the case, it may decide to
classify the SSC as low safety-significant.
MR. TRUE: Sorry. What page is that?
DR. SHACK: It's page 29. It's the second
paragraph from the bottom.
MR. TRUE: 29 and 30 are not --
DR. SHACK: I think what's it's saying is
that if it's meeting only because you've done such a
conservative analysis that you've thrown it way up,
they can then sort of argue it back down.
MR. TRUE: Well, this particular paragraph
has to do with SSCs that strictly got in on the basis
of high Fussell-Vesely and high failure probabilities.
DR. SHACK: Right.
MR. TRUE: Because what happens is, the
thing we were concerned about with that particular
paragraph was that often times you will have a base
CDF and there'll be a particular type of scenario that
is relatively important. And the PRA analyst will add
a recovery action of some kind which may invoke the
use of a system, import kind of a screening value on
that HEP and thereby bringing in the SSC as important.
An example might be refilling the RWST for
a steam generator tube rupture or lining fire water
for injection of certain cases.
It's given a conservative high HEP or high
failure probability, but it happens to address more
than the half of percent of the total CDF. And it
brings the sequence down in the process by -- that
recovery, it brings the sequence down in the mix still
above a half percent of the contribution. But it's
really kind of a screening approach to how important
that thing is. And we didn't think it was fair to
make those things get the same level of significance
if they were already treated conservatively with their
failure probability as something else that's being
modeled in a way and structured in the model.
Really only focused on that particular set
of high failure probability and recovery action type
things. It was something that was raised actually as
part of the BWR pilot not because it applied directly
to the systems they looked at, but because they
identified this could be a problem in future
applications.
So, that statement only applies to that
narrow set of circumstances.
Now, if we go to the flow chart that we
used for the IDP, basically what we asked the IDP to
do is to make sure that we've got the right functions
both to -- and core damage included. This kind of
talks to the way Tom was referring to in the IDP,
understanding how we've reflected the SSC. Then we go
over all the information on the basis for
categorization; the importance measures, the defense-
in-depth assessment, different hazards, how we
addressed all of those. And then their decision is is
the SSC reflected appropriately? That's really the
decision they get to make.
And if they think it's --
DR. KRESS: Well, does that mean to say is
the SSE categorized appropriately?
MR. TRUE: No. Is the SSC is reflected
appropriately in the inputs to the categorization
process? Have we got --
DR. KRESS: Oh, you got all the things
that bear on that SSC?
MR. TRUE: Yes. Right.
DR. KRESS: Okay.
MR. TRUE: And if the view it reflected
appropriately, then basically if it's identified as
risk significant, it stays risk significant and all
they're doing is confirming that we got the right
attributes and that they understand the attributes.
If it's found to be low safety
significant, then they're asked to look at the risk
information in more detail. They asked to look at --
and the basis behind why the thing was found to be low
safety-significant. They'll look at defense-in-depth
and safety margins. And then they're asked to make a
judgment about should it really stay RISC-3, but
they're given the flexibility to say no, I don't think
it should be RISC-3, it should go back up to RISC-1.
DR. SHACK: My problem with your viewgraph
is it doesn't seem to me to reflect the South Texas
experiences where the IDP actually classified most of
the components, you know.
This sort of focuses on what they're doing
when they get the PRA input and the PRA has sort of
done some preliminary classification. There seems to
be very little guidance for how they're to deal with
the components that aren't in the PRA in this current
version compared to the much more structured process
I thought we got from STP, where they immediately
realized that they were going to be doing a lot of the
categorization for things that weren't explicitly in
the PRA. And this flow chart really, you know, you're
thinking about things that are in the PRA when you're
looking at this chart, I think.
MR. BURCHILL: I think the upper part of
that chart is not at all restricted to PRA
information. That is, in fact, all information that
is gathered for the whole population of SSCs that are
being considered.
MR. TRUE: In fact, we think that the five
questions that STP asked are embodied in the flow
charts and things that we use in the categorization
process.
DR. SHACK: Then why not put them
explicitly in is sort of my question?
MR. TRUE: Well, I think they are. We're
going to get -- we'll get to that.
CHAIRMAN APOSTOLAKIS: Now let me see
where we are here, because --
DR. ROSEN: Well, let him answer the
question; why not put it in explicitly?
MR. TRUE: I think it is. These are the
five questions. And the first question has to do with
is it an initiating event. In the flow chart for
consideration of events related to internal events, we
have a question that says can the failure of this
component cause an initiating event. Okay. What we
call a --
DR. ROSEN: Where?
MR. TRUE: -- a complicated initiating
event.
CHAIRMAN APOSTOLAKIS: I didn't see it in
there.
MR. BURCHILL: I think it's 244. 244
page 27 on the right side of that flow chart.
Actually, it's at the top of the flow chart, the
diamond to the left and it's on the right side of the
flow chart relative to the complicated initiating
events.
MR. TRUE: Now, we did qualify it a little
bit more than South Texas did and not say all
initiating events. But we asked if it wa a
complicated initiating events and those which had an
importance greater .005.
DR. ROSEN: How did they know that up
front when they're at that stage?
MR. TRUE: The categorizers that are
providing information to the IDP will know that.
DR. ROSEN: Know that? The categorizers
will know that at that stage?
DR. SHACK: But see, that again means
we're dealing with components that are in the PRA.
CHAIRMAN APOSTOLAKIS: The PRA, yes.
MR. TRUE: Well, if it's not in the PRA --
well, it's either explicitly or implicitly in the PRA.
Implicitly includes the fact that the component's
failure could have effect on something modeled in the
PRA.
I mean, balance plant piece of equipment
that could cause a loss of turbine trip, we only have
an event that's a turbine trip event. That doesn't
have all the possible components. But those
components are implicitly in the PRA because they're
part of the turbine trip initiating event.
If a component has a function that's
totally independent of -- could create a challenge to
the plant or mitigating it, then it's not going to be
in the PRA and asking that question will it cause an
initiating event because it has nothing to do with it.
DR. SHACK: Well, I just have the feeling
that phrasing the question this way versus the South
Texas way gives a very different focus on what the
panel's looking at.
CHAIRMAN APOSTOLAKIS: Yes. But you said
I thought earlier, Adrian, that Rev. C will provide
some more structure, is that true?
MR. HEYMER: Well, Rev. C will pick up
some of the comments and the comment that Dr. Shack
mentioned about well if it's not modeled in the PRA,
is there guidance. And one of the feedback, we
certainly I think -- we had -- and correct me if I'm
wrong, Jason, from the Wolf Creek and I think from the
Quad Cities was specifically in that area that we need
to add something a little bit more explicit in the
guideline, what to do with components that aren't
modeled in the PRA as regards to guidance for --
CHAIRMAN APOSTOLAKIS: So you wouldn't do
something like --
MR. TRUE: There will be some more.
Particularly if they have this notion of implicit --
DR. ROSEN: And you're telling me that
there's protection against the IDP overriding the PRA
results and built into the structure. But I would be
more comfortable if in the wording of this thing it
made that absolutely clear and even referred to the
diagrams to say how that result is obtained by
correctly flowing through the diagram in the process.
MR. TRUE: Okay. I think that's a fair
comment.
MR. BURCHILL: I don't think Tom finished.
MR. HOOK: I just had a couple more points
on PRA quality.
CHAIRMAN APOSTOLAKIS: Let me say that I
think I'm going to lose at least one member at 12:00.
We have really addressed several of these questions in
the last 15 minutes. Maybe we can address the
questions that we have touched yet, like the fire. I
mean, we touched it earlier, but there were specific
questions how conservative it is and so on. And
anything else where you gentlemen disagree with what
the thrust of the question was? Because otherwise I
don't see how we can wrap this up in a reasonable
amount of time.
And the other thing is since you are
revising this, I wonder does the staff want us to
write a letter this time? Would you like to see a
letter from us? So we have to decide that ourselves
without input from an expert panel.
MR. REED: We're going to have to give
that some thought.
CHAIRMAN APOSTOLAKIS: Sorry?
MR. REED: We're going to have to give
that some thought.
CHAIRMAN APOSTOLAKIS: Give it some
thought, yes.
So, if it's okay with you, I'd like to
destroy your presentation and jump to things that --
I mean -- you can handle it.
MR. REED: Okay.
CHAIRMAN APOSTOLAKIS: Okay. So now,
Doug?
MR. TRUE: Yes.
CHAIRMAN APOSTOLAKIS: Shall we go to --
I mean, I think we disagree on the sensitivity
analysis and uncertain. I mean, all I'm saying is I'd
like to see a study that confirms that what you're
proposing is indeed reasonable, you know, instead of
doing these sensitivities and arguing that fifth and
95th percentile -- I mean, gee wiz.
MR. TRUE: Maybe I should put this a
little bit more directly. In my mind the purpose of
the sensitivity studies and the raising and lowering
of values across the board is a way to exercise the
model to see if there are opportunities because of
changes in evidence or information that SSCs are going
to break one of those thresholds.
CHAIRMAN APOSTOLAKIS: But it seems to me
that what you said earlier this morning is really
where the proper role of sensitivity studies is. If
there is a model uncertainty, I would be happy to see
those things. But see them on failure rates, I mean
when we can propagate that uncertainly in a travail
manner, I mean I don't know that that makes any sense.
MR. TRUE: Right. Maybe we should --
MR. HEYMER: And Bob -- Bob Lutz from
Westinghouse. In the AP600 didn't we look at
uncertainty and sensitivity and if we go to what
follows question nine?
MR. LUTZ: This is Bob Lutz from
Westinghouse.
I had prepared with the help of one of my
colleagues back at Westinghouse sort of a summary of
what went on on the AP600 new plant application a
couple of years ago where we did do a full uncertainty
analysis in that submittal as part of the
documentation for the design certification. And we
also did a number of sensitivity analyses. And I
tried to summarize on one slide.
We did the uncertainty analysis to try to
look at the CDF and LERF and make sure that we did not
have a large variation in CDF and LERF between the
mean and the 5th and the 95th percentile values. And
what we found is obviously specific to the AP600
design, but what we found is that between the mean and
the 95th and the mean and the 5th percentile values,
that we didn't see more than about a factor of 3
variation in the overall core damage frequency or LERF
numbers.
We also did a number of sensitivity
analyses, much more than what is being proposed here
in the Option 2 framework that's in NEI 00-04. And,
again, this is all documented back in the licensing
analyses. But we didn't see any SSCs coming from a
negligible contribution to LERF or CDF becoming a
dominant contributor when we did these sensitivity
studies.
In other words, nothing that had a RAW
value or an F-V value close to 1.0 changed to a
significant RAW or F-V value when we did the
sensitivity analyses. Now, that's what's documented
and it's -- within what we did, we didn't document it
in any of the licensing analyses, but within our how
house back when we were going through this.
We also looked at RAWs and F-Vs at the 5th
percentile and 95th percentile level. And, again,
found the same thing; that nothing that had an RAW
value, for example, near 1.0. In the mean case when
we went and looked at the 5th or the 95th percentile
case, nothing jumped up. So we had some confidence on
that application that nothing that was in the grass or
down in the background using the mean value would jump
up when we did sensitivity or uncertainty analyses.
And that's I think probably one of the
extensive comparisons that we do have to date of
sensitivities and full uncertainty analysis. I
brought this along just for what it's worth.
And, again, the plant design's a little
bit different, but it does show that in this one case
that there was no significant differences.
CHAIRMAN APOSTOLAKIS: Well, that's good
to know. But that was not in the report, and that's
part of what I have in mind as -- there is this paper
in the proceedings of the PSA conference '96, which
you are probably familiar with already.
MR. TRUE: Quad City meeting?
CHAIRMAN APOSTOLAKIS: Yes.
"Consideration of Probabilistic Uncertainty and Risk
Based Importance Ranking." And the distributions here
are Fussell-Vesely and RAW, and all that. I mean,
something along these lines would be helpful, you
know. This was done by graduate students. So maybe
you want to know which one it is, or you want a copy
now? We can give you a copy.
MR. TRUE: A copy would be great.
CHAIRMAN APOSTOLAKIS: Okay. We'll make
copies and hand them out.
MR. TRUE: Probably just the authors'
names and I can pull it out of the proceedings.
CHAIRMAN APOSTOLAKIS: Modares and
Agerwal.
MR. TRUE: I can't find that.
CHAIRMAN APOSTOLAKIS: It's PSA '96, page
230.
MR. TRUE: Even better.
CHAIRMAN APOSTOLAKIS: Volume 1.
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: And other things.
I mean, as I say, that paper by the distinguished
members from the NRC staff in reliability engineering,
which you probably have, would probably be a good one
to look at. You have that? "Use of Importance
Measures in Risk-Informed Regulatory Applications"?
MR. TRUE: Yes. Yes.
CHAIRMAN APOSTOLAKIS: You have it and you
promptly ignored it, right?
MR. TRUE: I didn't think any of us
ignored it.
DR. SHACK: I mean the one that shows the
point estimates are very close to the mean.
CHAIRMAN APOSTOLAKIS: Yes. And also
talks about the advisability of using the thresholds
as they are. Yes.
DR. ROSEN: So now where are we, George?
To the NRC staff?
CHAIRMAN APOSTOLAKIS: Well, let's talk
about external events, because that's really something
that I think bothers us. And we had a question or a
couple of questions, at least, on --
MR. TRUE: I have to say I didn't get the
same impression from reading the questions as I've
gotten here today. So, take me to the question that
you think --
CHAIRMAN APOSTOLAKIS: Well, question 16
and 17.
MR. TRUE: Okay. Sixteen, I missed --
understood what you were asking about. I thought you
were asking in 16 about places where we had PRAs
available, how do we handle them quantitatively. And
the answer was we looked at them individually and then
we compute these integral importance measures using
this equation. That's just basically weighting it
based on the CDF contribution of each hazard.
And then the sensitivity study we've
talked about looks at that.
So there must have been something more to
this question than I read from it.
CHAIRMAN APOSTOLAKIS: Well, go on to 17.
MR. TRUE: Okay. So then 17 question is
focused on fire versus fire PRA.
CHAIRMAN APOSTOLAKIS: So let's look at
these two figures now. 3.1-2. You don't have a
transparency, do you?
MR. TRUE: Yes, we do.
CHAIRMAN APOSTOLAKIS: Oh, great. Let's
put it up because that's important.
MR. TRUE: 3.1-1 and 3.1-2. Okay.
CHAIRMAN APOSTOLAKIS: Okay. Good.
MR. TRUE: This figure is effectively the
same as the internal events figure with the exception
that I loped off the initiating event question because
individual components aren't really contributors to
initiating events in the same way the fires as they
are for other internal events.
So basically the questions are is the RAW
greater than 2 or Fussell-Vesely greater than .05. If
it is, can it have been safety significant --
CHAIRMAN APOSTOLAKIS: Now let me
understand this. When you say calculate draw in
Fussell-Vesely for components addressed in 5 PRAs --
MR. TRUE: Yes.
CHAIRMAN APOSTOLAKIS: -- are you doing it
now with respect to the contribution to core damage
frequency from the fire --
MR. TRUE: From the fire.
CHAIRMAN APOSTOLAKIS: Not for the whole
thing?
MR. TRUE: From the fire and then at the
end we come back and take that important measure --
CHAIRMAN APOSTOLAKIS: And you weight?
MR. TRUE: And weight it and compute
overall.
CHAIRMAN APOSTOLAKIS: Now, again, I mean
that -- it sounds reasonable, but why is that
something we want to do? I mean, the whole idea of
the importance measures is to look at the whole PRA as
one entity and say this is the ranking. Right now we
are breaking it up and say no we're going to do a
separate one for fires, earthquakes, internal events
and then somehow put them together.
MR. TRUE: Right.
CHAIRMAN APOSTOLAKIS: I mean that's more
defense-in-depth it seems to me. So it's okay, but --
MR. TRUE: It's more defense-in-depth,
it's more conservative because we're breaking it apart
and looking at individual pieces. But at the end we
bring it back together and when we pass the
information to the IDP, we give them both contexts.
And basically what we said is if something is
important from an internal events perspective when
it's isolated by itself, it's important.
In my opinion we have a lot of confidence,
a lot of experience with importance measures and
internal events PRA. If we found that the importance
was high for another hazard source, then we give the
IDP that value plus the aggregate, which is the -- or
integral, which is the combination importance measure.
And if that fire or fire, for example, was a small
contributor to the total CDF, then we allow it to be
kind of diluted. But if it's a large contributor,
it's still going to be a significant importance
measure at the end, and we think that it deserves that
weight.
But if we combine them altogether and you
have a plant, for example, like Quad Cities that has
low internal events CDF and moderate fire CDF, then
nothing relating to internal events is ever important
because it's always swapped out by fire. And the only
things that are important are the fire mitigation
systems. And we didn't think that that was
appropriate because the basis on which you do fire PRA
is totally different than the basis on which we do the
internal events. And the uncertainties are different,
the input assumptions are different, and they're just
different beasts we felt deserved being separated
apart.
Within internal events we made an
allowance for the fact that if you were dominated by
some unique hazard like internal flooding, we said you
should pull that out and look at everything absent
that so that you don't swamp out the plant responses
and the defense-in-depth that's integrated in your
ability to respond to traditional initiating events by
this big lump that's a particular vulnerability to an
internal flooding or some unique hazard.
MR. BURCHILL: Let me add to that. As you
know, Quad Cities is one of my major challenges 4
years ago when I came to ComEd. And the fire PRA,
which is a overstatement, of course, that existed at
the time showed a hideously high core damage
frequency. And when we examined it, even casually, we
found that it was extremely poorly structured.
CHAIRMAN APOSTOLAKIS: But now let me come
back to what you and Doug were saying earlier this
morning about all these reviews and these engineers
who are reviewing the risk management programs and so
on, and that these -- we have high quality. How come
in that case --
MR. BURCHILL: It was a terrible product-
-
CHAIRMAN APOSTOLAKIS: You mean the
process was terrible as terrible?
MR. BURCHILL: The process that developed
it was a terrible process.
CHAIRMAN APOSTOLAKIS: So it was not what
you described here?
MR. BURCHILL: It is not what I described
this morning. It was not put in place since I've been
there.
DR. ROSEN: When did you say that was?
MR. TRUE: It was the IPEEE?
MR. BURCHILL: The IPEEE for Quad Cities
was developed in '96/'95. '95/'96 time frame. One of
my first challenges when I arrived on the scene in
January of '98 was to go look at this beast and find
out what was it telling us. And, you know, as I say,
even a casual examination showed me that it was very
poor. And I will in no way even try to rationalize
for you how it got prepared in the way that it was.
Now, when we went about to totally redoing
that fire PRA, we did exert the types of controls that
I described to you. But nevertheless, even with that
there were certain things that we did and did not do.
The major thing, of course, because fire
is a highly spatially dependent hazard, is you have to
know a great deal about all of your cable routings in
order to know exactly what gets impacted by a
particular spatially defined fire. And you have to
know then what you can take credit for. You have to
know both what the fire will impact so the fire
modeling comes into effect, and you have to know where
those cables are that are important to other pieces of
equipment's operation, which aren't even in that
spatial area. I mean, that's the whole challenge with
fire PRA.
So we spent -- you know, I don't want to
put this in numerical terms. But we spent a lot of
money to go chase cables. But we only spent a certain
amount of money. I mean, I won't say to you that I
know where every individual cable chase in that plant.
So in certain cases where we had a fire in a
compartment, you know, if we knew where the critical
pieces of equipment were that had cables through or
where the cables were for critical pieces through that
compartment, then we could explicitly model it.
If we didn't, then we just -- if we knew
it entered that compartment but we didn't know
precisely where it ran -- and frankly, it was
impractical to go track that down, we just assumed
that we lost that piece of equipment. I mean, this is
standard practice.
So, the fire PRA in my opinion at least
suffers in comparison to the internal events PRA from
two considerations. One is that the ignition
frequencies for the first are nowhere nearly as
sufficiently defined as our internal events initiating
event frequencies. And in cases of absence of
knowledge, we believe that we biased them in a high
direction; in other words, a conservative direction.
DR. ROSEN: But not all plants had that
problem of lack of knowledge of the configuration?
MR. BURCHILL: No, I understand that.
DR. ROSEN: Some plants knew precisely
where the cables are.
MR. BURCHILL: Some plants do. Some.
And then the second part is that point;
that the adequacy of your fire PRA to show a CDF
that's comparable to your internal events absolutely
depends on your intimate knowledge of those cable
routings.
So it's two things. It's the ignition
frequencies themselves and then the adequacy of the
cable routing knowledge so that you can do the fire
modeling.
Now, absent that I would submit to you
that if you have a -- and you'll challenge me on this
-- but a reasonable representation of the plant,
although still somewhat conservative, you can still
gain a great deal of information about what pieces of
equipment are really important for mitigating the
fire. And so now on relative basis I can look in my
fire PRA and I can say, you know, what are the
importance measures associated with equipment. And
that will tell me how important the equipment is on a
relative basis for responding to fire. But I wouldn't
pretend it to be directly comparable to the same
importance majors coming out of the internal events
PRA. You see what I'm saying?
And that's, I think, another reason for
separating this. Because you can gain information out
that fire PRA that's helpful to understand the
importance of equipment. And as Doug said, it could
go either way. You could either lose that information
or it could swamp the internal events if you lumped
them altogether, because they're not on the same
playing field. And I would submit there's very few
PRAs in which they are on the same playing field.
CHAIRMAN APOSTOLAKIS: Which essentially
comes down to how uncertain you are about the fire PRA
results really. And it's one way of --
MR. BURCHILL: And how you dealt with
that.
CHAIRMAN APOSTOLAKIS: It's one way of
handling.
So let's answer the question that was
raised.
MR. CHEOK: Actually, let me supplement
what Bill and Doug just said.
By separating the initiators we can gain
insights we cannot gain whereby lumping them. In
essence this kind of maybe relates to question 5 on
sabotage.
What happens when we have an event that
maybe could make a fire event more important, by
having this separate pieces of importance measures,
you can now deal with question 5 a little better
maybe.
CHAIRMAN APOSTOLAKIS: Well, the only
thing that worries me is that -- I mean, this is
reasonable. I don't recall in 1.174 having anything
like this unless you tell me to go read Appendix X.
MR. CHEOK: I think if you read Appendix
A --
CHAIRMAN APOSTOLAKIS: Oh, God.
MR. CHEOK: We do say that you need to
treat the importance measures cumulatively and
separately because each will give you a different
insights.
CHAIRMAN APOSTOLAKIS: Could you point me
to the page. I'd like to see that. And also it's not
just a matter of importance measures. I mean, I think
in general when you do risk-informed applications,
shall we start doing this in a consistent systematic
way and say now you have to separate fires from
internal events and do certain things? Let's not what
the basic approach says, right? I don't think -- I
mean, if you look at the figures in 1.174 --
MR. TRUE: It's total.
CHAIRMAN APOSTOLAKIS: It's total. It
doesn't say, you know, consider things separately. It
may be buried in Appendix A, something --
MR. CHEOK: But remember we are saying
that importance measures are not your decision making
tool. You see a delta change that is, the importance
measures are things that you bring into the IDP for
them to deliberate on.
CHAIRMAN APOSTOLAKIS: Right. Right.
MR. CHEOK: These are insights you bring
in to the IDP. And I think we mentioned it this
morning in terms of defense-in-depth. You know, a RAW
value basically tells you SSCs that are in single,
double or maybe triple event cut sets, so you're
talking about things that are maybe sensitive to
defense-in-depth in terms of levels of protection.
Fussell-Vesely would tell you whether an
SSC appears in many different cut sets which tells you
that, you know, it's there to mitigate a lot of
different functions.
CHAIRMAN APOSTOLAKIS: My point was that
if you look at the basic diagrams that are in the main
body of 1.174, there is no distinction between parts
of PRA that are done poorly or very conservatively
versus other parts that are not done that way. There
is one global delta CDF that you have to consider.
And now what I'm saying is that, you know, this sounds
reasonable to me. Maybe that idea of treating certain
things differently from others should be studied more
carefully and maybe change the basic approach.
Because I don't know what delta CDF means. Now if we
do it for fires or for something else in light of what
Bill just told us.
Anyway, that's an idea. Let's go back to
the question here. Where is the corresponding, you
know, that diamond you have there are all greater than
2?
MR. TRUE: Right.
CHAIRMAN APOSTOLAKIS: If I go to the next
figure --
MR. TRUE: Okay. Let's go and we have one
there, too. Okay. What we did here is -- well, let
me back up.
In our five analysis we start with a fire
scenario and you look for factors which can allow you
to screen that fire scenario out. And screening it
out means that its frequency gets below one times 10-
6.
So you say I'm going to have a fire in this area, it
causes this much damage, what are the things that are
left and what are the systems that could suppress or
terminate that scenario. And once you've gotten that
scenario below 10-6 you stop. You don't continue to
recover it to try and refine into a true CDF. You
just screen it below 10-6 and say I don't have to
worry about it anymore. It's not a vulnerability in
my plant. That's what fire was really intended for is
to identify vulnerabilities.
And so when you're all done you end up
with screened scenarios and unscreened scenarios.
Unscreened scenarios are those that you could never
get below 10-6 even though you incorporated all the
success paths and information that you had available.
And so what we said was that for a
component that participates in an unscreened scenario,
it's used to mitigate -- an unscreened scenario, so
it's part of a scenario, it's built into my 6, it's
automatically safety-significant. I don't care if
it's --
CHAIRMAN APOSTOLAKIS: It's a candidate?
MR. TRUE: It's a candidate. Well, it's
safety-significant and then whether it's safety
related or not makes it a candidate of RISC-1 and
RISC-2, and that's passed on to the IDP to make the
final decision about.
DR. ROSEN: And even the IDP and all its
glory can't change that?
MR. BURCHILL: That's right.
MR. TRUE: Right.
CHAIRMAN APOSTOLAKIS: So let me
understand --
MR. BURCHILL: And it can't ever get to
RISC-3?
CHAIRMAN APOSTOLAKIS: It can never get to
RISC-3?
MR. TRUE: Right.
MR. BURCHILL: Right.
MR. TRUE: Okay. So then we're left with
what about all those ones that you squeezed below the
10-6? There could be a bunch of them and the risk
could actually be large. And so what we said there
was that if it doesn't participate in one of those
scenarios, then we're going to make it low. So what
we're saying is it didn't really have anything to do
with fire risk. But if it does participate and it was
part of the reason you were able to screen it below,
then we ask if you didn't credit that, would you bring
that scenario back above the threshold and make it an
unscreened scenario.
So it's sort of like a risk achievement
kind of a look at it to say if I don't credit that as
a I come out of this box and move back into this other
box over here, where we said everything was important,
so we're taking all the things that participated in
the unscreened and all of those that helped to screen
out scenarios and putting those back in. So those
come back down and, again, are RISC-1 or 2.
MR. PARRY: Can you walk me through
George's door?
MR. TRUE: The barrier, I think what I
said about barriers was that you would have to have a
fire PRA -- I think what the guidance is you have to
have a fire PRA that was focused on looking at that
barrier which would take you back to the other figure
and we wouldn't be using this figure. And I think you
would use the same process and basically say --
MR. PARRY: Most people don't have a fire
PRA that looks on barriers.
MR. TRUE: Right.
MR. PARRY: Okay. So what do they do with
barriers?
MR. TRUE: They are not allowed to -- they
don't have a compelling case to move it from safety
related, a/k/a RISC-1 to RISC-3. So it remains RISC-
1. Or it remains under whatever program it's in. It
may actually be in an augmented program, in which case
it starts in RISC-2 and stays in RISC-2.
MR. PARRY: So we've got what? A thousand
fire barrier penetration seals that are always going
to be in a high risk category, RSC category?
MR. TRUE: Safety-significant category?
MR. PARRY: Yes.
MR. TRUE: Yes. Without having done an
analysis to show that they are, they remain in the
safety-significant category.
MR. CHEOK: Unless you can show that they
are not important in screening out of the sequences in
your fire screening analyses. In other words, if you
had used the barrier to justify fire independence, you
have to maintain the current programs unless you can
show that even if you remove the programs, the
screening does not matter.
I think the staff also has one more
question with respect to this figure, and it's a
little more subtle than just the typical barriers when
you do screening. When you go to the PRA leg of this
figure a lot of people would define fire damage
states. And when you define fire damages states, you
take credit for things like fire suppression systems,
sprinklers, response from the fire department,
wherever.
MR. TRUE: Right.
MR. CHEOK: And that gets to be put into
your split fractions in your fire damage stated
entries.
MR. TRUE: Right.
MR. CHEOK: That things don't normally get
propagated to the final cut sets because in your final
cut sets you come in with a single event where you say
it's damaged stage 3 -- where you have, you know, a
large fire that is suppressed in 3 minutes. So in
essence when you have -- when you take credit for
suppression systems, that seldom gets propagated to
the importance measures, and the staff has a question
for NEI on that.
MR. TRUE: I'm not familiar with your
question, because I frankly haven't taken the time to
go through all your questions on top of these 23. But
what I'll say about that is that I believe we can use
the same -- I agree with you that it's uncommon to see
those show up in traditional importance measures, but
I believe that we can use the same basic importance
measure concepts, RAW 2, Fussell-Vesely and .05 for
those systems. It just would take a separate
calculation to look at what the benefit you're getting
out of those systems is.
MR. CHEOK: I think this is something we
need to discuss more. Because we define a lot of our
runs over our fire property runs by using certain
parameters like suppression systems and I'm not sure
if that actually gets propagated all the way to the--
or can get easily propagated to the importance
measures. But that's something we need to discuss
more.
MR. TRUE: Okay. It's probably a place
like where we need more -- maybe we could use more
guidance than the guidance document.
CHAIRMAN APOSTOLAKIS: And all this
assumes, of course, that whoever did the 5 kept track
of the screen scenarios, right? If they have not,
they cannot apply this. Do they keep that
information?
MR. TRUE: Yes. Yes. Yes, as part of the
5 processes.
CHAIRMAN APOSTOLAKIS: How about if you do
the HCLPF in -- what do they call that, in seismic?
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: It's the same idea?
MR. TRUE: It's the same basic concept in
that what we're saying is that the seismic margins
approach was intended to make sure we didn't have any
vulnerabilities to seismic risk. And in that process
you were required to have two safe shutdown paths that
you had -- 1 is the PRA one which looks like every
other PRA one.
Basically what we said there was that if
you have identified that component as being part of
your safe shutdown paths in your safe shutdown
analysis for seismic margins, it is -- if it supports
the safe shutdown path, then it is safety-significant.
If it's not something that's important to
one of your safe shutdown paths, then it's not and it
goes to a --
CHAIRMAN APOSTOLAKIS: And if you do all
this, you cannot really develop the integral -- what
you call the integral form of importance measures
because you don't have a CDF, right?
MR. TRUE: Right. And you -- that
aggregate calculation and the sensitivity study at the
end will vary by a factor of 2 to 5. Obviously
doesn't get factored back in here.
CHAIRMAN APOSTOLAKIS: So how does that
work now?
MR. TRUE: But the --
CHAIRMAN APOSTOLAKIS: In other words what
you just said is, if I understand correctly, that we
cannot really calculate delta CDF?
MR. TRUE: For the seismic contribution.
CHAIRMAN APOSTOLAKIS: Oh. So we don't
know whether we meet 1.174, do we? Especially given
the fact that these things are among the significant
contributors a lot of the time.
MR. TRUE: But all of these -- what we're
-- all of these that are credited are going to remain
treated. So it's the ones that aren't on the success
path that are possibly be moved to RISC-3 or 4. If
they make it through all the other screens and those
aren't what we need in order to assure that our
seismic risk is low.
So the ones that were included to make
sure our seismic risks are low, stay safety-
significant.
CHAIRMAN APOSTOLAKIS: Right.
MR. TRUE: So it's the ones that are not
part of that that are kind of marginal helpers in the
seismic risk area, you may want to look at it.
CHAIRMAN APOSTOLAKIS: Yes.
MR. TRUE: Those are the ones that
potentially might change by a factor of 2 to 5.
CHAIRMAN APOSTOLAKIS: Right. And that we
don't know the impact.
MR. TRUE: And those are the random
failure rates anyway of the components that we're
changing by a factor of 2 to 5. So, yes, we're
missing a small slice of the delta CDF, but we felt
like because we were taking everything on that path,
that --
CHAIRMAN APOSTOLAKIS: That's an
interesting point you just made. In these analyses,
for example, in the seismic analysis we had the
ragility curves, right? When you do you 2 to 5
calculation, you don't touch those, do you? Because
they're not --
MR. TRUE: We were going to change just
the random unreliability --
CHAIRMAN APOSTOLAKIS: Only the random?
Oh. Okay. Interesting.
Okay. Anything else on the questions?
MR. TRUE: We had a lot of discussion
about this, is it conservative, is it not
conservative?
CHAIRMAN APOSTOLAKIS: No. I think the
way you describe it is conservative, that's my
impression. The way you describe it here.
MR. TRUE:
DR. SHACK: Well, we tried. It was
actually our intent. Good.
DR. SHACK: Well, I'm not sure in this
one, though, if you had a relatively large seismic
contribution, that you could be sure that the delta
CDF with the other paths were small. You know, it
becomes -- it's one of these thing where the -- yes,
you've gotten the largest one and you've made it
manageable, but it's not clear to me that the delta
CDF associated with the others is necessarily small.
It's just -- it's not dominate.
You know, in the 5 at least you've got a
10-6. You know, a have a quantitative criterion for
what you've screened out.
MR. TRUE: Yes.
DR. SHACK: In this one all you know is
that, you know, it's less than the two that you've
picked.
MR. TRUE: Yes. I think that my
impression, and I'm not the seismic expert for sure.
My impression is that if you're able to meet the
HCLPFs in the seismic margins approach, that you can
have reasonable confidence that your total CDF from
seismic is going to be on the order of 10-5. And so
-- and that's for the things that are treated.
Now, you may be actually above 10-5 if
your HCLPFs didn't meet the earthquake, but we've
already got all those components that didn't meet the
HCLPF because they're a part of our safe shutdown path
for making it safety-significant.
So we're talking about some change to a
fraction of the 10-5 kind of a value, which gave me
some confidence that we're still kind of in that same
ball park.
DR. SHACK: Yes. But if delta CDF is --
I mean, you know, it's a small contribution to the
total CDF, but when you're looking at the deltas that
you're interested in, is not -- you know, we're not
looking at 10 to the 4th anymore. You know, if you're
going to demonstrate that the delta CDF is small --
MR. TRUE: It's between 10-6 -- or less
than 10-5 and, hopefully, less than 10-6. Yes. But
it's not all that --
CHAIRMAN APOSTOLAKIS: Shall we move on?
Now, in the common-cause failure area --
MR. TRUE: Yes.
CHAIRMAN APOSTOLAKIS: -- on question 20,
which -- and 21 is blank. Oh. Okay.
MR. TRUE: We didn't understand that.
CHAIRMAN APOSTOLAKIS: Why should -- no,
I thought your --
MR. TRUE: We didn't understand 21.
CHAIRMAN APOSTOLAKIS: Well, it's related
to the comment I'm about to make.
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: I think the
implication in 20 or what you're doing in here is that
the common-cause failure term is a separate event
because in RAW and Fussell-Vesely can be calculated.
In other words, I have a PRA, I have --
MR. TRUE: What you said is statement of
the facts, right?
CHAIRMAN APOSTOLAKIS: Yes.
MR. TRUE: That's true.
CHAIRMAN APOSTOLAKIS: And the thrust of
these questions is that it really isn't, but if this
component A fails, it effects -- that fact effects a
number of terms. I mean, when I calculate RAW and I
set that component down, it should effect a term that
has only random failures, it should effect the term
has common-cause failures, because that component is
down now.
MR. TRUE: Okay. Yes, but the --
CHAIRMAN APOSTOLAKIS: So we're not going
to take the common-cause failure term as a separate
entity, as if it were a separate component in other
words?
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: So -- yes, go
ahead.
MR. TRUE: Let's take it one at a time.
Fussell-Vesely is effectively setting the
failure rate to zero, right?
CHAIRMAN APOSTOLAKIS: Yes.
MR. TRUE: So that takes the common-cause
term to zero. So Fussell-Vesely I think we --
hopefully we can agree that the approach of
considering all of those together addresses that.
CHAIRMAN APOSTOLAKIS: Considering what?
MR. TRUE: We take the sum of all t he
Fussell-Veselys and assign that to be the Fussell-
Vesely importance of the component.
CHAIRMAN APOSTOLAKIS: And that's bounding
or what is it?
MR. TRUE: Well, I believe it's bounding.
MR. PARRY: It is, because they're
independent failure modes of the component.
CHAIRMAN APOSTOLAKIS: Mutually exclusive.
They're mutually exclusive.
MR. PARRY: That's right. But -- that's
right.
MR. TRUE: Yes.
MR. PARRY: So the cut sets are mutually
exclusive. So --
MR. TRUE: Unless by some chance you had--
MR. PARRY: Well, there may some --
MR. TRUE: -- the same component had to
work one way and then work a different way.
MR. PARRY: But then it would be in a
different phase.
CHAIRMAN APOSTOLAKIS: So in essence what
you're --
MR. PARRY: And you would get a different
sequence.
I think it's true that it's the right way
to do it.
MR. TRUE: Yes. It's the right to do it.
It's certainly not --
CHAIRMAN APOSTOLAKIS: But you are talking
about the Fussell-Vesely of a single component now
that has 3 failure modes, right?
MR. TRUE: Right.
CHAIRMAN APOSTOLAKIS: You are not
addressing the question of how to handle the common-
cause term also?
MR. TRUE: I'm trying to do that.
CHAIRMAN APOSTOLAKIS: Okay.
MR. TRUE: So there's a figure -- the
answer to question 22, what we probably should work
from and then we'll get -- and you had a question
about that table. Get the table out of the report and
corrected an alignment problem that we had in the
report, which I apologize for.
So basically what we did was we said okay,
in a PRA a component has various failure modes.
Independent failure modes and common-cause failure
modes. What we want to do in the area of Fussell-
Vesely is we're going to compute a component in
Fussell-Vesely importance, and for doing that we're
going to take the sum of the individual component
failure mode Fussell-Vesely importances. So these
Fussell-Vesely importances sum to this .00952 value.
CHAIRMAN APOSTOLAKIS: So this is the sum
of all these four numbers.
MR. TRUE: The sum of those numbers, yes.
Because the decimal points align, it's not obvious
that that's the case, but that's what it is.
DR. ROSEN: We'll trust you.
CHAIRMAN APOSTOLAKIS: Well, but wait a
minute now. Let me -- the failure to open versus
failure to remain --
MR. BURCHILL: Right. It's not physically
possible that those both occur unless they're time
dependent failure situations in a scenario. But at
least we have -- that's why we think it's conservative
because we've actually added what may be in fact
mutually exclusive failure modes.
MR. TRUE: You can't fail or remain open--
shouldn't be able to fail or remain open and fail to
remain closed in the same -- at the same time.
DR. ROSEN: Well, if you get caught in the
middle.
MR. TRUE: Well, you could, yes. Although
that usually would be categorized as one failure or
the other.
CHAIRMAN APOSTOLAKIS: But the common-
cause failure again represents now what kind of
failure? To open or to remain closed?
MR. TRUE: To open. To open. We don't
usually have a common-cause term for failed to remain
closed.
DR. ROSEN: Closed.
CHAIRMAN APOSTOLAKIS: And you have a --
oh, there was a number there. So the .004 is --
MR. TRUE: Is it's importance. That
actually happens to be the most important of the
Fussell-Vesely importances.
CHAIRMAN APOSTOLAKIS: So this Fussell-
Vesely now is calculated by assuming -- by treating
the common cause term as an independent separate term,
is that what that means?
If I go to the PRA and I set that common-
cause term equal to what, zero?
MR. TRUE: This term? Yes.
CHAIRMAN APOSTOLAKIS: Then it will get
.004?
MR. TRUE: It will reduce the total by
.004
CHAIRMAN APOSTOLAKIS: Okay. And as if
nothing else happened?
MR. TRUE: Yes. There's a basic event in
the model that says common-cause failure of these two
valves.
CHAIRMAN APOSTOLAKIS: Right.
MR. TRUE: And I computed that with an
alpha factor model or a beta factor model, or whatever
model. But I have a basic event that says common-
cause failure, this .004 reflects the Fussell-Vesely
importance of that basic event.
CHAIRMAN APOSTOLAKIS: Although in
reality, I mean if you use the alpha factor or the
beta -- I mean the multiple Greek letter method, 1 and
4 really have the failure rate of valve A times beta
and gamma?
MR. TRUE: Right. Right. Right. I agree.
CHAIRMAN APOSTOLAKIS: So they're really
not independent basic events. I mean, you know,
lambda appears in both?
MR. TRUE: Right. But if we're going to
zero, I think they all go to zero at the same time.
CHAIRMAN APOSTOLAKIS: They all go to zero
at the same time. But that's not how you calculated
the Fussell-Vesely. You set one versus equal to zero
and then the other. You don't put them down at the
same time.
MR. PARRY: George, maybe -- excuse me.
The way you calculate them, they're not independent.
But they represent independent failure modes of that
component because the valve A fails to open is what's
classified as the independent failure to open. Event
4 is that subset of those failure causes of valve A
that would also fail all the others.
CHAIRMAN APOSTOLAKIS: Right.
MR. PARRY: So they are, in fact,
independent events from the point of view of physics.
It's just that when you calculate it by taking the
lambda for 1 and multiplying by a few betas or alphas.
CHAIRMAN APOSTOLAKIS: But if you do that,
I mean the importance of lambda is different. It also
effects two terms.
MR. PARRY: Well, that's -- yes, but
that's why they're adding them. They're not looking
at the --
CHAIRMAN APOSTOLAKIS: Can they
demonstrate that if you add them, you get the correct
result --
MR. PARRY: They're not looking at the
importance of lambda. They're looking at the
importance of the component.
CHAIRMAN APOSTOLAKIS: Right. And that's
not something that's obvious to me. He just says that
we are doing it this way without any justification. I
have to sit down and figure it out myself if it's
correct, and I don't like that.
MR. TRUE: You don't like that you had to
figure it out?
CHAIRMAN APOSTOLAKIS: Yes. Because them
I have to do the same for RAW. I have to understand
every line you have here. And, you know, why should
the user have to do this? Can you just explain why
these things are reasonable? Somewhere.
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: Okay.
MR. TRUE: We can explain that, why
they're reasonable.
CHAIRMAN APOSTOLAKIS: Good.
MR. TRUE: The next one may be somewhat
more contentious because I don't think the staff
agrees with this completely.
MR. PARRY: You are right.
MR. TRUE: Okay. We've resolved the fact
of how we calculate the component importance for
Fussell-Vesely, right? That's clear what we're doing?
CHAIRMAN APOSTOLAKIS: Well, I understand
what you're doing. It's just that it's not clear to me
that it's reasonable what you're doing. But I
understand what you're doing. Now let's go to RAW.
MR. TRUE: Okay. Let's go to RAW.
CHAIRMAN APOSTOLAKIS: But you said you
can supply proof that it's reasonable. So, you know,
I'll wait to see it.
MR. TRUE: Okay. For RAW in the PRA we
have in the same individual basic events, and we can
compute a RAW for each of those individual basic
events. And we in our categorization process have
said that we will not include the common-cause -- the
RAW of the common-cause term as part of our
computation of the total component importance from a
RAW perspective and unless -- unless the conditional
probability of the additional components failing
that's used in alpha factor method is less than .005.
And the reason for that is that if it's greater than
.005, which in most cases it is -- it's usually around
-- between .01 and .1, then the Fussell-Vesely is
going to be bounding anyway. Because the only way to
get a RAW of 2 with a Fussell-Vesely lower than .005
is if the failure rate or the event that you're
setting to true has a value that's smaller than .005.
CHAIRMAN APOSTOLAKIS: Doug, and you
expect the reader to figure that out? Why don't you
supply some arguments that this is --
MR. TRUE: There's a footnote that
describes it.
CHAIRMAN APOSTOLAKIS: There's a footnote
which I never understood.
MR. TRUE: Okay.
MR. PARRY: I have got to say I don't
really understand the footnote either. Because I
think it refers to the conditional common-cause
failure probability, which is the product of the
alphas.
MR. TRUE: Right. It does.
MR. PARRY: Yes. Whereas, in fact by
using the same argument that you used to sum the
Fussell-Veselys you can turn it around and say that
you also have to consider each of these basic events
when you're considering RAW. Because remember what
these separate events are is they're separate failure
modes, if you like, of the component. Therefore, why
would the common-cause failure -- the common-cause
failure mode is a very strange one in that it also
impacts other components. But it still fails
component A, and therefore it's equivalent. So I
think you should consider it.
CHAIRMAN APOSTOLAKIS: Isn't the problem
stemming from the fact that item 4 is treated as a
separate entity from 1 and 2? I mean, if you say the
common-cause failure -- forget failure rates.
The term is QA times data.
MR. PARRY: Yes.
CHAIRMAN APOSTOLAKIS: Then I'll go
everywhere in my PRA, I'm looking for the RAW of A.
And wherever I have Q of A I'll set it equal to one.
MR. PARRY: You could do that --
CHAIRMAN APOSTOLAKIS: Clearly, I could.
I mean, that's what I must do.
MR. PARRY: No, no, no, no.
CHAIRMAN APOSTOLAKIS: There's a
difference between must and could.
MR. PARRY: No, not necessarily.
CHAIRMAN APOSTOLAKIS: Not necessarily.
MR. PARRY: Right. Because what you're
assuming is that the impact of whatever change you're
doing is only effecting the random failure
probability. It could equally effect the coupling
factor between the components A, B and C.
CHAIRMAN APOSTOLAKIS: It could. It
could.
MR. PARRY: And by doing what you suggest,
but you're only focusing on --
CHAIRMAN APOSTOLAKIS: But it's a step in
the right direction.
MR. PARRY: It's a step in the right
direction.
CHAIRMAN APOSTOLAKIS: Because the
component is down.
MR. PARRY: It's a step in the right
direction.
CHAIRMAN APOSTOLAKIS: Yes.
MR. PARRY: But there is no right answer
to this because RAW is itself a very --
CHAIRMAN APOSTOLAKIS: Oh, but there is a
wrong answer.
MR. PARRY: Yes, and I think this is the
wrong answer.
DR. ROSEN: This is the wrong answer and
a --
MR. PARRY: But there's no right answer in
the sense that RAW is such a strange extreme
importance measure.
CHAIRMAN APOSTOLAKIS: I want to know what
happens to the CDF if this component is down. Now, in
the community's wisdom the common-cause failure is
represented by 2 times beta times gamma, times delta.
Well, if I have accepted, then I have to go and set Q
equal to zero, to 1 there. Now, whether beta, gamma,
delta will also go up is another question. But I
think I would go back to the comment that, you know,
how much can they go up. Because they're already
pretty high. It's the Q that really brings everything
down by -- I mean, beta is 10 percent, gamma is close
to one. I mean, how much are you going to change it.
Change it a little bit if you want, but it's the Q
really that brings everything down.
MR. PARRY: Well, the --
CHAIRMAN APOSTOLAKIS: And it seems to me
that's the way it should be done.
MR. PARRY: It depends what you're
thinking you're doing, I think. It's --
MR. TRUE: Let me take a brief stab at
defending what we did.
CHAIRMAN APOSTOLAKIS: I think you should.
And I think that comes back to my request for a study
that documents all these things.
MR. TRUE: Okay. I think that several
things -- I think we can agree on several things.
Common-cause RAW is an extreme term. It's
saying that all the components in that group fail 100
percent of the time for 100 percent of the year and --
DR. ROSEN: Now calculate CDF on that
basis.
CHAIRMAN APOSTOLAKIS: Wait a minute.
MR. TRUE: And calculate CDF.
CHAIRMAN APOSTOLAKIS: Where does it say
that? It doesn't say that.
MR. PARRY: Where does it say that?
CHAIRMAN APOSTOLAKIS: The way you
calculate its importance says that, and that's what
I'm objecting to.
MR. TRUE: No. It's the RAW term for
common-cause event in a PRA --
CHAIRMAN APOSTOLAKIS: And that's what I'm
saying.
MR. TRUE: You set it to one --
CHAIRMAN APOSTOLAKIS: You could never
calculate the RAW of the common-cause event, that's my
point. Because it doesn't make sense. It's not a
basic event.
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: We call it basic
event, but isn't.
MR. PARRY: But it is a basic event.
MR. TRUE: So you agree with me, you're
running -- you agree. You're agreeing that's --
CHAIRMAN APOSTOLAKIS: I -- what I'm
saying is that --
MR. TRUE: You happen to agree with that.
CHAIRMAN APOSTOLAKIS: What I'm saying is
that, yes, the codes do treat it as a separate basic
event, but in fact it is a coupled event with the
other things. And if you look at the multiple Greek
letter method, for example, then it's obvious that Q
is everywhere. And you are really calculating the RAW
of A. So you're setting A equal to -- I mean, QA
equal to one for failure of the unavailability going
to one and then you should go to all the terms in the
PRA that have that QA and set it equal to one.
MR. PARRY: That's an artifact of the way
you calculate --
CHAIRMAN APOSTOLAKIS: A what?
MR. PARRY: That's an artifact of the way
you're calculating the common-cause failure --
CHAIRMAN APOSTOLAKIS: But that's what
you're doing. I mean, you can't do it this way here
and later on say no I'm not going to do that anymore.
MR. PARRY: You got to go back to what the
definition of the events is. And the event -- the
first event is the random failure of component A. The
fourth event is the failure of component A in
conjunction with other components. But it's still a
failure mode of component A. That's the way those
events are defined in NUREG 47 and its subsequent
progeny. But it's an artifact of the way that we
calculate the probabilities of those events that you
calculate anyway to use lambda.
CHAIRMAN APOSTOLAKIS: I'm surprised you
have to pay for the multiple Greek letter model.
And the other thing that really I think is
upsetting right now is that we are doing this analysis
here in real time, talking to each other, and the
question is why hasn't the Office of Research
investigated these things and settled them once and
for all? Is it so difficult? Why? Would it take a
million dollar study to do these things? No. Why do
I have to come here and at 12:00 listen to Gareth tell
me that it's an artifact and it doesn't matter, and
this and that, and then Doug give something else?
I mean, if we are to have --
MR. PARRY: I didn't have the math,
George.
CHAIRMAN APOSTOLAKIS: I know you didn't,
but I want to put words in your mouth.
If we -- I mean one of the goals of the
agency is to have -- to build and maintain public
confidence, right? I don't think we're doing that by
doing things like that and arguing the last moment,
yes, it makes sense, it doesn't make sense. It seems
to me we should have a piece of work somewhere that
documents that these things make sense, they are
conservative or they're not conservative, and this,
and this and that.
MR. PARRY: Well, actually, we do have a
comment into NEI on this particular point. So that
does --
CHAIRMAN APOSTOLAKIS: Well, this
committee has issued reports that are more than 2
years old commenting on the problems with importance
measures. I'm not sure anybody read them. The study
should have been done already to settle the issue of
importance measures and how you calculate them.
MR. CHEOK: George, there's no one from
the Office of Research here, but I guess I'll speak
for them a little bit.
They do have a limited study on importance
measures, and Louis Chu here from BNL is helping them
do it.
And I think in terms of common-cause
failures, I believe that the results show that there
were four additional SSCs that would become important
if you had included the RAW common-cause failure.
CHAIRMAN APOSTOLAKIS: So we should wait
then until we see the study from Brookhaven before we
say anything about this?
Are you addressing these questions, Dr.
Chu? Come up here to the microphone.
DR. CHU: Okay. This is Louis Chu,
Brookhaven Lab.
I think -- I work on some calculation
using the Sequoyah SPAR model.
In terms of calculating the RAW
considering the CCF, we -- I did I think exactly the
way George described it. That is, in the SPAR model
you calculate a common-cause failure probability in
terms of the alpha factors times the Q value. So
there's an expression for it.
And it happens that the SPAR model has the
capability of, you know, you fail the component it
will recalculate this common-cause failure
probability. As a result, I believe this is the right
way, the accurate way of accounting for common-cause
failure when you calculate a RAW value.
CHAIRMAN APOSTOLAKIS: So you're saying
not to consider the term as a separate entity and
calculate its RAW, but calculate the RAW of Q, which
appears in two different places?
DR. CHU: Yes. We -- we --
CHAIRMAN APOSTOLAKIS: For the component?
Even though Gareth says it's an artifact, which I
agree. Because--
MR. PARRY: And, actually, we disagree
with Louis -- at least I disagree with Louis' point of
view, too.
CHAIRMAN APOSTOLAKIS: Well, thank you
very much. I mean, that proves my point. We don't
have a definitive study that tells us how these
things--
MR. PARRY: I don't think the study is
going to help you. But we know we can do it several
ways, but you've got to get back to thinking what are
you trying to do with evaluating the importance
measure. And if you're trying to get the absolute
importance of component A, then you have to look at
all its failure modes. That's --
MR. TRUE: But it is only a portion of the
common-cause --
MR. PARRY: Well, yes, but it doesn't
matter. If that common-cause fails A, it's a
different failure mode of A.
MR. TRUE: Then -- then --
CHAIRMAN APOSTOLAKIS: But it does fail A.
MR. PARRY: Yes.
MR. TRUE: Then I think we need to
reconsider the use of the criteria 2 for that kind of
a failure mode. Because it's something that's totally
different. We're taking a whole group of equipment
and failing it and saying that exists for 100 percent
of the year at least --
MR. PARRY: It's only different in degree,
Doug.
MR. TRUE: -- for a component that's
certainly out of service --
MR. PARRY: It's only different in degree.
You're doing that with all the individual failure
modes. So what's the difference there? That's also
an extreme measure of the importance.
CHAIRMAN APOSTOLAKIS: Well, we cannot
resolve --
MR. PARRY: No, no. Things don't happen
for the whole year, which is what you're saying the
common-cause failure is.
CHAIRMAN APOSTOLAKIS: Obviously we cannot
resolve that issue now.
MR. PARRY: Right.
CHAIRMAN APOSTOLAKIS: And I don't know
how we can resolve it if you guys insist that nobody
should look into it and document it someplace. But a
study will not help me; I really don't understand
that. I really don't.
I mean, I would like to see something that
documents what Louis just said, what Gareth claims and
so on and draw some conclusions. Why is this issue
different from anything else that we study and say,
you know, this is this way and this is not that way.
I don't understand that we have to do it in real time
here arguing that it doesn't mean this, and then Doug
says we should reconsider the threshold. Well, gee,
you know -- so I'm not sure we can reach a conclusion
right now.
MR. PARRY: No, but I think you heard that
from Mike and from Louis that there is a -- there is
someone looking into this.
CHAIRMAN APOSTOLAKIS: Okay. So --
MR. PARRY: So I think at the end of that
we will come up with some position.
DR. SHACK: And it makes a difference of
4 components?
CHAIRMAN APOSTOLAKIS: Yes.
MR. PARRY: In a particular example.
DR. KRESS: That hardly seems worth, does
it?
DR. SHACK: Four 4 components?
DR. ROSEN: What do you mean by 4
components? Four components in the whole analysis or
-- what does is this reference to 4 components?
MR. CHEOK: I think this is four
additional components in one plant model.
MR. TRUE: But is there only two common-
cause groups? Is that all that it brings in?
MR. CHEOK: I don't know the details.
CHAIRMAN APOSTOLAKIS: I don't know, guys.
We are wasting our time now.
And the other thing is that I hope this
study will not just say we did it for Sequoyah and
this is what we found. I mean, there may be some
logic behind all this and go back to the definitions;
what does RAW mean, is it meaningful to really claim
that when a component is down, everything goes down?
You know, that kind of thing. It is not just that we
provide is numerically for this plant and we got these
numbers. I mean, that's useful insight, too, but it
seems to me the definitions here -- and I think that's
where Gareth was going -- you know, what does it mean
that I have a common-cause failure of 2 valves?
Right? What does it mean that one valve fails as a
subset? You know, that kind of argument would go a
long way to convincing me, at least, that we know what
we're doing.
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: Okay?
MR. TRUE: Okay.
CHAIRMAN APOSTOLAKIS: All right. Now, I
don't have any more questions.
DR. ROSEN: Is it lunchtime or are we
done?
CHAIRMAN APOSTOLAKIS: I don't have
anymore questions or comments unless my colleagues
around the table -- Peter? Steve?
DR. ROSEN: Are we going to hear the NRC
staff?
CHAIRMAN APOSTOLAKIS: Well, the NRC
spoke.
DR. SHACK: The ultimate piŠce de
resistance of all this is how we calculate delta CDF.
CHAIRMAN APOSTOLAKIS: The two to 5.
DR. SHACK: The 2 to 5.
CHAIRMAN APOSTOLAKIS: Yes, the 2 to 5.
DR. SHACK: You know, it's like question
15
MR. TRUE: Right. That's about the only--
CHAIRMAN APOSTOLAKIS: Let's discuss that
one for a few minutes.
MR. TRUE: Okay. I guess the issue here--
it's actually 14 and 15 are related to this.
It is true that South Texas, they do a
calculation where the value's increased all the way to
a factor of 10. They also did lower values. We don't
know if they actually did 5, but I know they did 2 and
some other intermediate value.
I think that the core of the issues here
is that 10 is just as arbitrary as 5. Twenty is just
as arbitrary as 10.
CHAIRMAN APOSTOLAKIS: But you didn't pick
20.
MR. TRUE: Right.
CHAIRMAN APOSTOLAKIS: Is that by chance.
MR. TRUE: We believe that the evidence
that we have seen -- well, we haven't seen evidence
that it will change by a factor of 10. That the
evidence that was presented by South Texas in their
submittal actually said it probably isn't going to
change a lot. And there is some --
CHAIRMAN APOSTOLAKIS: What is it that's
changing? The mean value of the distribution?
MR. TRUE: The mean value. Yes. The mean.
CHAIRMAN APOSTOLAKIS: The mean value?
MR. TRUE: Yes.
CHAIRMAN APOSTOLAKIS: Not the --
MR. TRUE: I would say the point estimate
value wasn't changing because they didn't -- I'm not
sure they actually computed a mean. But the point
estimate they compared didn't change significantly
between the two groups. I don't remember whether they
computed --
CHAIRMAN APOSTOLAKIS: Is that the Idaho
study that --
MR. TRUE: No. This is --
MR. TRUE: We're talking in South Texas.
CHAIRMAN APOSTOLAKIS: Well, was --
MR. TRUE: Now, there are -- there are --
DR. KRESS: It was based on that.
CHAIRMAN APOSTOLAKIS: I thought that
there was an Idaho study, wasn't it?
DR. KRESS: Yes, I think so.
CHAIRMAN APOSTOLAKIS: It was not a South
Texas study?
MR. TRUE: It was South Texas. There may
be some work from Idaho, but I haven't seen that.
So we start off with a dearth of evidence.
But the evidence that we have says it don't look like
it changes a lot. Then there's a pretty big change.
DR. SHACK: Two to 5 is a small change.
MR. TRUE: Two to 5 is more reflective of
what we've seen. And given that the evidence shows
there's not a lot of change, we said well if there's
not -- the evidence says there's not a lot of change,
maybe we should just be operating within the same
distribution and moving our value we're using from the
mean out towards a more 95th percentile kind of value.
And, as you know, the nature of the
lognormal distribution is that the mean doesn't get
more than about a factor of 4 away from the 95th
percentile. And, in fact, as the uncertainties get
larger, once you get above about a range factor of
about 20, the mean starts approaching the 95th
percentile and can even pass the 95th percentile.
So the graph on the next slide between 14
and 15 shows the simple property of the lognormal
distribution that the range factors we typically deal
with on these kind of parameters are down in the low
310, 30 kind of a range. But the ratio of the 95th
percentile to the mean in that range is below a factor
of 5 and above a factor of 2.
So we said if we're going to do it and we
don't have evidence that the mean does shift or the
point estimate -- factors where it does shift, what we
don't believe will happen. We believe individual ones
may go up by a factor of 2 or 5 maybe at times. But
we'll take them all at the same time and see what the
delta risk is.
It's only a sensitivity study. And here's
a point that Steve made earlier, it's not intended to
say this is how bad it's going to get, this is where
it's going to go. It's just to say that if this
happened, as a sensitivity what would the implication
be on changing the CDF.
And that's the basis for the 2 to 5.
DR. KRESS: Well, the fallacy in that
argument is staying within the same --
CHAIRMAN APOSTOLAKIS: Yes.
DR. KRESS: There's nothing that I know of
to say.
MR. PARRY: Well, everything's changing.
It has to change some.
CHAIRMAN APOSTOLAKIS: It's a matter again
of going back and understanding what the distribution
represents. Is a plant-to-plant variability that the
reactor safety study talked about? And what if you're
one of the plants that is on the tail already? Right?
Or does it mean something else? You know, these are
the kinds of things that I think we need a little more
careful investigation.
Does the whole distribution change or not
doesn't change, or --
MR. PARRY: I think also it's setting a
dangerous precedent in some ways that that uncertainty
distribution is purely a reflection of what we know
about the parameters for the state of the plants as
they exist at the moment. If we then start using that
as an excuse for changing it; when we change the state
of the plants, then I think that's -- it's
intellectually dishonest, let's put it that way.
CHAIRMAN APOSTOLAKIS: And you say 2 to 5.
Now the problem is what if I do it for 3 and it
doesn't pass the criterion, then I go down to 2 and it
does, then what do I do? You say --
MR. TRUE: Yes, I think in the end I
believe we're going to end up picking an A number
based on treatment. But we have yet to define what
treatment we're going to do.
CHAIRMAN APOSTOLAKIS: Can you document
that somewhere.
MR. TRUE: If a change in treatment is
nominal, we think that the change in reliability would
be nominal.
CHAIRMAN APOSTOLAKIS: Okay.
MR. TRUE: If it's more significant, then
it might be more significant.
DR. ROSEN: Can I ask a few questions?
CHAIRMAN APOSTOLAKIS: Yes.
DR. ROSEN: I just wanted to clarify with
Adrian that what you're going to do with this is come
back with another draft of it? And that's going to
take out all the treatment stuff as well as be
responsive to what you know of the Commission's -- of
the staff's intent with regard to 50.69?
MR. HEYMER: We will take a look at their
comments, factor those in. We will take a look at the
lessons learned we've documented from the pilots, and
there's still one more pilot to go. And once we've
done that, we'll take an attempt to redraft it. We'll
meet with the task force to review it. And then we'll
submit it as Rev. C.
DR. ROSEN: Could you answer my question
about the treatment?
MR. HEYMER: The treatment -- the
guideline based on some decisions that were made in
January will focus just on treatment. Just on
categorization.
DR. ROSEN: And all the treatments on it
will be --
MR. HEYMER: The treatment it's our intent
to call that out and put that into a specific industry
guideline that will not be endorsed by the NRC.
DR. ROSEN: Okay. Thank you.
MR. HEYMER: And industry guide.
DR. ROSEN: Now I have another question,
which is really goes to our agenda, which is that I
came to hear what the NRC -- to hear what the industry
said in response to our questions for sure, and you've
done an credible job doing that. But I also came to
hear what the staff thought of NEI 00-04.
Can somebody from the staff respond to
that, Mr. Chairman?
MR. CHEOK: Can I real quickly mention
about the 2 to 5 factor 2. The staff has asked I
guess NEI to justify the fact that 2 to 5, NEI has
submitted to us data from STP. The staff has not
looked at this data yet and I guess we eventually may
do that. But I guess treatment also gets factored
into this factor 2 to 5.
What happens if you pick a factor of 5
even? Does that mean when treatment is IST, does that
mean you cannot increase the test intervals from 3
months to more than 15 months because the 5 bounds you
to your lambda T by 2 factor? So we need to pull
treatment into this discussion when we talk about
factors of 2 to 5.
DR. ROSEN: Now you answered the question
about this particular point. But I was more generally
asking the question overall; what is the staff view
about Rev. B of NEI 00-04? Do you have any comments
on it beyond that?
MR. REED: Steve, I can say a few words.
DR. ROSEN: Yes, go ahead.
MR. REED: I'm just going to focus on one
slide. It's going to reiterate a lot of what was said
to start off the meeting that Adrian mentioned at the
very beginning of the meeting.
It starts with a little bit of history,
but I think it's important to keep remembering this.
Because I think often times we lose the context and we
lose the bigger picture.
We've been doing this since back in '99
when we came out with SECY 99.256 with ANPR. That's
what started this whole thing really rolling. And
since then NEI has been developing the document. And
we are now on the third round of comments that I
believe you all have a copy of, which was sent to NEI
several weeks ago. And those comments reflect both
our review of draft Revision B as well as all the
pilot activities that have been observed to date being
collected.
The reason I think that we didn't hear a
strong opinion a whole lot on these specific issues is
the fact that we are largely in agreement. Now, you
look at the comments and, of course, there's a pretty
long list of comments. But to me, anyway, looking at
the entire Option 2 picture and categorization, I
don't think we're far off. We have some big issues in
other areas, but in the categorization area I think
all of these can be technically solved. I may be a
little too optimistic here, so that's why I'm saying--
DR. ROSEN: What do you mean big issues in
other areas? What other areas are there besides
treatment?
MR. REED: Yes, exactly.
DR. ROSEN: Are you ready to talk to that?
I thought you opted out of treatment?
MR. REED: Well, no, I'm talking about in
terms of in the rule. For example, I'll give you an
issue of whether 50.55(a), a special treatment
requirement, whether those requirements should be
placed on RISC-3 SSCs or removed from RISC-3 SSCs.
That's a very big issue.
In fact, we met yesterday with NEI and
ASME on that particular issue to try to understand,
you know, gather more information to help us make a
decision on whether that should be one of the list of
the special treatment requirements that should be --
you know, the requirements that should be removed from
RISC-3.
As you know, South Texas was exempted from
pieces of 55.55(a).
DR. ROSEN: Yes.
MR. REED: For Option 2 we've been
considering in this particular instance all the way
from 55.55(a) requirement staying on RISC-3 to the
pieces being removed in a similar fashion to South
Texas, or the entire regulation being removed from
RISC-3. So, it's a very big issue. In fact, I think
it's the biggest issue.
DR. ROSEN: I would really be puzzled if
you deviated from what you did at South Texas. I
mean, it seems to me it was agonizing in the staff
when we came to a conclusion. Why would you want to
recognize that? You don't have to answer that.
MR. REED: Well, it's been very agonizing
for us, I can certainly agree with you on that. And
there are other issues.
I know this Committee and this meeting
today was focusing on the concerns and issues on the
categorization process, and so that's what we were
focused on here today. And --
DR. ROSEN: But I would echo your comment
about 50.55(a). I mean, 50.55. I am concerned that
we are doing something -- that we would do something
different and that -- and I said why earlier on, was
that this is about scope. It's always been about
scope; that which is within the special treatment
requirements and that which is not. And so if you
start using code cases, you're not really talking
about scope anymore. You're really talking about
iterating with the fine detail. And I think that's
the essence of my trouble of going with an approach
that relies on code cases rather than dealing with it
directly in this building.
MR. REED: To continue then, as I think
you probably gathered then from -- we were trying to
meet on a few of the technical issues where I think it
was very clear that, you know, for example on CCF and
RAW, that there were some disagreements. But, by in
large, we weren't trying to do a lot because, in fact,
we are I think in fairly good agreement on the
categorization process and, you know, understanding
that ACRS may have some concerns separate from that.
But, you know, I just pull out what I
think we would consider the three biggest issues. And
I think all these are solvable.
The issue of long term containment
integrity and its consideration within defense-in-
depth. The issue of the IDP guide, that's where I
think where we agree with the ACRS. I think it's also
been a feedback from the pilot activities. And I
think NEI recognizes in fact that there needs to be a
little bit more structure and guidance to the IDP.
DR. ROSEN: Can I stop you right there?
MR. REED: Sure.
DR. ROSEN: In my view what came out of
the experience at South Texas was the absolute
importance of the IDP. We really didn't anticipate
that at first at South Texas. It wasn't clear to us
when we started that that was how it was going to
shake out. But it became clear very soon.
And so the things that were done to
select, to train and qualify the members of the expert
panel, the IDP, and its working group became very
important. And the structure that they worked in
because it was going to be so difficult, we could see.
The answers were not just going to come out of the end
of a computer.
The issues of structure and scrutability
became even more important. Documentation, clarity.
Even continuity of membership of the members; didn't
want to have people scuffling in and out of the thing.
And that the guideline is absolutely almost silent on
those issues, which to me turn out to be some of the
important issues, the soft issues, if I may call them
those.
So, I would encourage both the staff and
NEI to pay more attention to what we found to be some
of the more important dimensions of this process.
MR. REED: I think all the parties agree
that there needs to be some work done there, and it's
already been mentioned this is a interim product. And
so we'll see how it evolves to the next Rev. I think
it will.
And, of course, the last item there, this
is a big issue, it's a lot of what was talked about
today. In fact, Mr. Burchill talked quite a bit about
PRA quality. But that's a very important aspect of,
you know, is your PRA is a sufficient quality really
to support this categorization process? And, you
know, staff has -- work has been underway for quite
some time reviewing the peer certification process.
And we recognize that that's something that will have
been done. Now the question is what's necessary for
licensees to implement Option 2, what do they need to
provide to the staff as a submittal for us to take a
look at so we can conclude that, yes, what you've got
there in place is good enough to implement this to
Option 2.
And it just really turns into a review
guidance for the staff in reviewing a submittal to
support this. And we actively are working on that,
you know, right now.
So, you know, a very quick overview. What
I'm really trying to point out is we're pretty far
down the road here. We're on the third round of
comments. We're not too far off in categorization.
We have some big issues. From the staff's perspective
I think we can solve. We're hearing, you know, some
issues of course from the Committee.
In fact, George, I think we would like if
possible to get a letter from the Committee. I think
it would help us do our job better. Because we need
if possible to get these concerns documented to help
us when we get to the proposed rule stage to help
address this when we bring the proposed rule to the
Committee.
So, if possible, I think we would
appreciate a letter. I understand there's a lot of
views bouncing around, that's going to be a difficult
thing for you to do. But --
DR. ROSEN: If we agreed to that, you'd
get a letter on Rev. B of NEI 00-04. You need a
process letter? Because we know they're going to
change it?
MR. REED: Yes, but it helps us -- some of
these concerns are pretty broad based and I think it
would help us, I believe, to try to have them
addressed as we go forward. That's -- in other words,
to be better prepared and hopefully get the proposed
rule package to this Committee. That's my thinking
going forward. But, you know, again, what we were
focused on was the issues and concerns from the letter
from the ACRS, and we were charming in as we went
along. And that was the main focus. This is really to
give you a view of where we stand.
And, of course, you have our letters, our
specific comments on NEI 00-04.
CHAIRMAN APOSTOLAKIS: Any other comments
from the members?
DR. ROSEN: Well, I have one more, George.
CHAIRMAN APOSTOLAKIS: Yes. Go ahead.
DR. ROSEN: On this last point, the
relationship of NEI 00-02. It was my understanding
that that relationship was nil, and that is -- and let
me give you my version of it and I will stand
corrected if you can help me, or if Adrian can help.
00-02 describes the PRA certification
process. It is part of -- it is referenced in the
ASME standard. The standard stands tightly linked
with the PRA certification process. And 00-04 invokes
the standard, which it hence evokes 00-02. Those are
not separable things. We insist on good quality PRAs
to support this process would be required. And,
therefore, need to meet the standard, the ASME
standard which -- or if you prefer a shorthand, you
need to meet 00-02 but I think it's a more complete
thing and it's certainly scrutable to the public,
which may or may not have access to 00-02, to say that
you need to meet the ASME standard which incorporate
the certification process which is explained in 00-02,
although it stood alone before that. I mean, it was
part of another process.
So, I don't think -- to me the
relationship is not unknown. I'd be interested in
your views.
MR. PARRY: Yes, I think the relationship
is not unknown in general, but I think the question is
what can the staff make out of what the reports say
about -- what submittal that come in using NEI 00-04
said concerning the definition of quality, if you
like, that came out of NEI 00-02. And I think the
staff has some concerns about that, largely because
what we have to do as the staff, I think, is to be
convinced that the risk input to the IDP is adequately
supported by the licensee's PRA. Okay.
Now, for us to do that I think we have to
understand precisely what has gone into NEI 00-02 and
how the grading process has gone on. And there are
some things that I think that we feel a little nervous
about.
For example, and our understanding is that
NEI 00-02 requires the documentation of facts and
observations when a grade 3 is not awarded to a
particular element. I may have this slightly wrong,
but that's at least what we read into it. But there
are equally important issues that are related to the
assumptions that the analysts have made. I'm going to
give you a good example, like the HRA method, for
example. Human reliability analysis method. They may
meet the criteria that are in the ASME standard and
the other requirements, I should say, and in NEI 00-
02, but those are flexible enough that they would
allow a licensee to use any one of a number of
different methods which could give you very different
estimates of human error probabilities.
To some extent that worries us less in
Option 2 on that particular issue because one of the
requirements is for the licensee to do sensitivity
studies on human error probability values, for
example, which would make us feel more comfortable
that they haven't obscured SSCs because of using very
conservative HEPs or they haven't pushed some SSCs to
be unimportant because of using very optimistic HEPs.
But nevertheless, there are issues like
that that we're sorting through that I think that we
have to have more confidence about to accept the
results of a categorization using NEI 00-04 coupled
with NEI 00-02. And that's the guidance that Tim
talked about that we're putting forward as to which of
these areas do we need to look at.
And just to give you one of the reasons I
think why this occurs, is that the sub-tier criteria
on which the grading is performed in NEI 00-02 we
don't feel that they clearly define what goes into the
grades, and in particular what goes into grade 3. So
knowing something that has grade 3 doesn't tell us
what was done.
CHAIRMAN APOSTOLAKIS: Adrian?
MR. HEYMER: Yes. You had a number of
questions on the certification process, and we didn't
really get to those today. We covered the PRA quality
ones in some depth. And I think before we can sort of
look to some response from this Subcommittee or the
full committee, is I think we need to explain where we
are with regards to certification process and Option
2, and respond to some of those questions.
If we want to start discussing those now,
we'll introduce --
CHAIRMAN APOSTOLAKIS: Well, that brings
up another issue. We will have a presentation at the
full Committee meeting, right? An hour and a half?
Are you planning to come, NEI?
MR. HEYMER: We're planning to be there,
yes.
CHAIRMAN APOSTOLAKIS: Well, maybe, you
know you can focus on major issues and not take every
question that we have asked in detail and address them
then.
MR. HEYMER: We can focus on the major
issues, but I think we also need to emphasize that
this document will change. You'll probably see, I
wouldn't say substantial changes, but there will be
changes in certain areas like the IDP guidance, and
there were some specific reasons why we went down that
approach.
CHAIRMAN APOSTOLAKIS: Yes.
MR. HEYMER: And what I understand the
staff needs some help in input is regards to drafting
the notice of proposed rulemaking, it is a notice of
proposed rulemaking. It is not the final rule.
CHAIRMAN APOSTOLAKIS: Yes.
MR. HEYMER: And we still have a long way
to go. There are some substantial issues on the table
not associated with categorization.
DR. ROSEN: I would only comment, now that
I've listened to the staff and Adrian, NEI, that I'm
a little bit uncomfortable with the idea, mainly from
what you said, Gareth, that the staff is worried about
or is uncomfortable with some tier guidance in the NEI
00-02 in the certification process.
It seems to me that that process is now
embedded in the standard and the proper place to have
voiced those concerns and had them addressed was in
the consensus process. And to now be worried about
that at this stage smacks a little bit of wanting to
change the outcome of the consensus process. I may be
wrong about all that, but think about that comment in
the light of what you said.
MR. PARRY: Yes, I'd like to respond to
that. I don't think that the fundamental process of
a peer review is reflected both in the standard. And,
obviously, the peer process is NEI 00-02. However,
NEI 00-02 has not been changed to reflect the
consensus process that was done in the standards. So
that is a different issue.
And I think it's actually no secret that
we have been concerned about the sub-tier criterion in
NEI 00-02. We've made this point over the last 3 or
4 years. So I think this is nothing new. This is
just a continuing situation. But I think that, you
know, the standards is something -- is another animal
and that's in terms of the requirements. They're
clearer, I think, than the sub-tier criteria of NEI
00-02.
DR. ROSEN: So what you're saying is that
NEI needs to conform 00-02 to the standard?
MR. CHEOK: Actually, I think both NEI and
the staff recognize that there are some differences
between 00-02 and the standard. And as a result of
that, I think NEI has asked the staff to look at 00-02
with respect to Option 2. And I guess to provide
comments as to the adequacy of 00-0s with respect to
Option 2.
DR. ROSEN: Well, it doesn't make any
sense to me to have another set of how you do things
different from the standard. I think both NEI and the
staff understand that it'll have to come together on
the issue of peer certification ultimately.
CHAIRMAN APOSTOLAKIS: Okay.
MR. BURCHILL: Can I make a comment?
CHAIRMAN APOSTOLAKIS: Yes, sure.
MR. BURCHILL: I want to just clarify
something that Gareth said, and then I also wanted to
make a comment on the relationship between the
standard and 00-02.
In the NEI 00-04 there is an outline of
the submittal an applicant would make relative to this
categorization process. And in it it's stated that
the applicant should have a high level summary of the
results of the peer review including any PRA elements
that are graded below 3 in the standard elsewhere --
or the guideline rather elsewhere says that it's
expected that a grade 3 is the nominal grade measure
of capability of the PRA for this application. But it
also says that the disposition of all peer review fact
and observations classified as A or B would be
reported.
And there's a clear distinction between
the grading scheme under the peer review process and
the fact and observation sheets which their level of
significance relative to the capability of the PRA is
measured in this A, B, C category. And everything in
the A/B category, whether it is associated with an
element that was graded, you know, 1, 2, 3 or 4, it
doesn't matter. All of those are to be reported and
how they were dispositioned.
So, I just wanted to clarify that there's
two different dimensions to how that's actually done.
And that's required by the guideline to be included.
Relative to the ASME standard and the peer
review process, I think it is -- help me on this. I
think it's section 6 of the standard that refers to
the peer review process. I think --
MR. PARRY: Yes, I think that's right.
MR. BURCHILL: Yes. I think section 6
refers to the peer review process. And at least in
the last draft that I've seen, I think which is 14(b)
I believe, it's very clear that there's a very tight
linkage between the standard and the peer review
process. And, in fact, having just gone through it
myself personally in order to look to adapt that
element of the standard to the one that we're working
on for low power and shutdown in ANS, you know, what
I found is that it very tightly ties the peer review
process into determination of compliance with the
standard.
And, in fact, the owners groups jointly
have underway with the BWR owners group in the lead
presently, a very detailed comparison between the sub-
element criteria in the peer review process and what
the standard calls out. And I think by the time that
we're in a position to apply this under Option 2 that
will have become in widespread use in the industry for
demonstrating through the peer review process how the
PRA compares to the standard.
MR. PARRY: Can I just add to that?
MR. BURCHILL: Yes.
MR. PARRY: I think where the comparison
has to be made, Bill, if that would be compatible is
at the sub-tier criteria level.
MR. BURCHILL: Right.
MR. PARRY: And at the supporting level
requirements of the standard. When that comparison is
made, then I think they will be more --
MR. BURCHILL: That is what we're doing.
MR. PARRY: Okay. Good.
DR. ROSEN: Good. That's very helpful.
And I think that that linkage between those things is
what was intended when we set out on this process.
CHAIRMAN APOSTOLAKIS: Okay. So is it
clear now what the presentation at the full Committee
meeting is going to be? The presentation will be by
you or you and NEI, or just NEI?
MR. HEYMER: Well, I think there's been
some confusion over the full Committee meeting,
George. What actual date is that?
CHAIRMAN APOSTOLAKIS: March --
MR. MARKLEY: Let me get the agenda real
quickly. Yes.
MR. PARRY: The 7th, I think.
MR. MARKLEY: I think the 7th, but I can't
tell you the time off the top of my head.
CHAIRMAN APOSTOLAKIS: It's March the 7th
at 10:15 in the morning.
MR. HEYMER: We need to caucus amongst
ourselves to make sure that we can get the right
people here for that.
CHAIRMAN APOSTOLAKIS: Okay. So it's
primarily the staff then if they come.
MR. REED: And to make sure I understand,
this is going to focus on NEI 00-04 and the staff's
issues with 00-04 now?
CHAIRMAN APOSTOLAKIS: Well, it says
proposed NEI 00-04.
MR. REED: Okay. In other words, not
focusing on ACRS questions and concerns about on what
our issues are?
CHAIRMAN APOSTOLAKIS: The whole report,
yes.
MR. REED: Okay.
CHAIRMAN APOSTOLAKIS: Okay. I take it
there are no more comments from my colleagues or
questions?
Well, I thank the gentlemen from the
industry for taking the time to come and talk to the
Subcommittee, and staff members.
DR. ROSEN: Before we adjourn --
CHAIRMAN APOSTOLAKIS: Yes?
DR. ROSEN: We should discuss amongst
ourselves, not that it's secret but just with the
ACRS, the desire to write a report at this stage. I
think the staff has asked for that.
CHAIRMAN APOSTOLAKIS: Yes, the staff has
asked for a letter, yes.
DR. ROSEN: A letter. And the question I
have is --
CHAIRMAN APOSTOLAKIS: Well, let's go
around the table and see how people feel about it.
Who wants to start? Peter?
DR. FORD: I've still got a concern about
a time dependent --
CHAIRMAN APOSTOLAKIS: No, but should we
write a letter?
DR. FORD: My consideration is no.
CHAIRMAN APOSTOLAKIS: No.
DR. ROSEN: My consideration is no also,
because I think it's a work in progress. There are so
many questions that I have about this that I would
like to see the final draft. I think if we wrote a
Larkins Graham that said something like we think there
hadn't been the right direction, we're glad to see
that the staff and NEI at least from the staff's point
of view we believe have general agreement, that it's
likely to be a success path; that's fine. But I don't
think we're ready to write a letter to the Commission
on it.
CHAIRMAN APOSTOLAKIS: Bill?
DR. SHACK: I sort of agree that we
shouldn't write a work in progress. You know, if
we're going to have fundamental problems with things
like using fixed values for Fussell-Vesely, you know,
and the staff seems to be heading down that road, then
you know, maybe we do need to write a letter if
there's a consensus that that sort of detail is a show
stopper. I just don't know.
I think we'll need some discussion among
ourselves to kind of -- you know, if we looked at the
staff questions on 00-04 and we've looked at our
questions on 00-04 -- you know, suppose they did
resolve all their concerns? Would that resolve all
our concerns? I don't think all of Mario's concerns
will be addressed. But then, I'm not -- you know,
he's standing in front of a train here.
CHAIRMAN APOSTOLAKIS: Now when you say we
discuss, today or at the full Committee?
DR. SHACK: Somehow in an informal caucus.
You know, as to whether -- what issues are still open
for us.
CHAIRMAN APOSTOLAKIS: With all the
members?
DR. SHACK: I think with all the members.
You know, it seems to me, for example, a lot of my
concerns with the IDP sound as though, you know,
that's in such a state of flux.
CHAIRMAN APOSTOLAKIS: It is in a state of
flux.
DR. SHACK: That, you know, I don't see
there's any point in saying anything about that. You
know, the treatment of uncertainties and the use of
fixed Fussell-Vesely values, you know, that I'm not
sure is going to be addressed in any changes that I
sort of foresee coming from -- and, you know, if we
feel that's a show stopper, then --
CHAIRMAN APOSTOLAKIS: Okay.
DR. SHACK: -- we should fire off on that.
But, you know, my inclination is that my big questions
were on the IDP, and that seems to be in such a state
of flux that I don't see any real point in writing a
letter at this moment.
CHAIRMAN APOSTOLAKIS: Dana?
MR. PARRY: It seems that you pointed out
a variety of areas where you thought there needed to
be some developmental refinement of the technical
foundations of the methods. And it seems to me that
it would be useful to document those needs within a
letter that says basically this process is going on
pretty well. And that what the staff and NEI are
doing is a pretty good thing. That the technical
foundations may need to be shored up and in these
areas we think that it would be useful to shore them
up and lay them out and whatnot, so that they're in
front of people and people can act on them.
CHAIRMAN APOSTOLAKIS: So the way I
understand what Dana proposed is, you know, write
something that recognizes that things are in a state
of flex and a lot of the concerns we raised are being
addressed. But here are 1, 2, 3, 4, however many
there are issues where we feel we have to express our
views now for the benefit of both NEI and the staff as
they work on this revision? I think that's what you
said?
MR. PARRY: Yes.
CHAIRMAN APOSTOLAKIS: There are certain
things we feel we should document at this stage. And
we don't have to, you know, be exhaustive and say well
we have a worry about the IDP, but that's being
addressed.
DR. ROSEN: Well, I think that's the point
that I would -- I mean, I could agree with Dana's
suggestion, except that I wouldn't want a letter that
we wrote now to be viewed by anybody as being
inclusive or exhaustive.
CHAIRMAN APOSTOLAKIS: No.
DR. ROSEN: Because there's lots of things
that we talked about.
CHAIRMAN APOSTOLAKIS: And we can say
that, yes.
DR. ROSEN: Including the IDP, etcetera
that we -- there's no point going into a detailed
discussion of it at this point until we see what they
come back with.
MR. PARRY: I wouldn't want it to be
viewed as exhaustive. Similarly, I wouldn't want
people to look at the areas where technical
foundations need to be shored up to say -- and you
can't do anything without shoring these. I didn't
hear anything that was so fundamental that -- in the
area of technical foundations that without its
resolution we were hamstrung. I saw it a matter of
persuasion, a matter of convincing that the
approximate solutions were correct. I didn't see it
-- I didn't hear any of them that said and this is
likely to be a fatal flaw in these approaches.
CHAIRMAN APOSTOLAKIS: That's true. I
guess an element that at least I tried to bring up
here is the element of rigor and public confidence.
Okay. And a lot of the responses have been, yes, but
this doesn't matter or, you know, this is okay. We
tried it in one place and it worked. And I want to see
a little bit more there. And I believe there is a
disagreement or at least an initial disagreement or
not willingness to go along by both the staff and the
industry. And that's something that I would like to
document.
MR. PARRY: Well, there is an element of
public confidence that's going to have be confronted
sooner or later, and it's the question of if you are
a heart surgeon, do you want a grade C student. I
mean, if you're a heart patient do you want a grade C
student doing the heart surgery on you? And, you
know, it is --
DR. ROSEN: I think the analogy is not
entirely apt.
CHAIRMAN APOSTOLAKIS: I wouldn't want to
challenge the analogy right now. But you were in the
middle of something.
Okay. I would suggest --
MR. PARRY: I don't want to stand in front
of a freight train.
CHAIRMAN APOSTOLAKIS: I would suggest
that Dr. Kress has agreed to send me an email -- I'm
sure he will send it to everyone here -- with his
views as to what should be in the letter. I think
he's working under the assumption that there will be
a letter, but you know, we can always talk to him.
And I would urge you to do the same. In fact, it is
Steve and I who are working on this. So if you can
send both of us some points that are along the lines
of what we just said; that it will not be an all
inclusive letter. It will not address everything. It
will acknowledge up front that this is work in
progress, but here are a few things that we feel we
ought to document at this stage knowing full well that
the staff and the industry are still working on this
document.
So, please send those to us. And then
Steve and I will think about drafting something,
perhaps.
DR. ROSEN: To bring to the full
Committee?
CHAIRMAN APOSTOLAKIS: Of course, to bring
to the full Committee. Okay?
And, again, I thank everyone for coming
here and spending time with us.
And this meeting of the Subcommittee is
adjourned.
(Whereupon, at 12:52 p.m. the Subcommittee
was adjourned.)
Page Last Reviewed/Updated Monday, July 18, 2016